what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Watu PRO 4.8.8.4 Cross Site Scripting

Watu PRO 4.8.8.4 Cross Site Scripting
Posted Sep 1, 2015
Authored by Tom Adams

Watu PRO version 4.8.8.4 suffers from a stored cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 720722e6007782ede3707fb5ce01ddfaf1a95e702e90393cf7603916016c0b30

Watu PRO 4.8.8.4 Cross Site Scripting

Change Mirror Download
Details
================
Software: Watu PRO
Version: 4.8.8.4
Homepage: http://calendarscripts.info/watupro/
Advisory report: https://security.dxw.com/advisories/stored-xss-in-watu-pro-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

Description
================
Stored XSS in Watu PRO allows unauthenticated attackers to do almost anything an admin can

Vulnerability
================
An attacker able to convince an admin to visit a link of their choosing (e.g. through phishing) is able to execute arbitrary JavaScript. This makes use of a CSRF vulnerability (no nonce protection on the options form)

Proof of concept
================
If a logged-in administrator user clicks the submit button on this form, a JavaScript alert will display on /wp-admin/admin.php?page=watupro_options (in a real attack the form can be made to auto-submit using JavaScript):
<form action=\"http://localhost/wp-admin/admin.php?page=watupro_options\" method=\"POST\">
<input type=\"text\" name=\"upload_file_types\" value=\""><script>alert(1)</script>\">
<input type=\"text\" name=\"save_ajax_settings\" value=\"Save Ajax Related Settings\">
<input type=\"submit\">
</form>

Mitigations
================
This issue has been discussed with the author, who disagrees that there is an exploitable issue. We maintain that the above proof of concept demonstrates this issue. Nonetheless, the author has told us that they have made changes to address the problem in version 4.9.0.8 of this plugin. We have not verified these changes, so our recommendation is to upgrade to version 4.9.0.8 or later, and ideally conduct your own security assessment of this plugin.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2015-08-11: Discovered
2015-08-11: Reported to Author via email
2015-08-11: Author responded
2015-08-26: Author reported fixed in version 4.9.0.8
2015-09-01: Published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.




Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close