what you don't know can hurt you

WordPress Supsystic Digital Publications 1.6.9 XSS / DoS / Traversal

WordPress Supsystic Digital Publications 1.6.9 XSS / DoS / Traversal
Posted Feb 8, 2021
Authored by Erik David Martin

WordPress Supsystic Digital Publications plugin version 1.6.9 suffers from cross site scripting, denial of service, and traversal vulnerabilities.

tags | exploit, denial of service, vulnerability, xss, file inclusion
MD5 | 20cf753fe2b0be4cf71a7b33d728cf4f

WordPress Supsystic Digital Publications 1.6.9 XSS / DoS / Traversal

Change Mirror Download
# Exploit Title: WordPress Plugin Supsystic Digital Publications 1.6.9 - Multiple Vulnerabilities
# Date: 24/07/2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/digital-publications-by-supsystic.1.6.9.zip
# Version: 1.6.9
# Tested on: Ubuntu 16.04.6 LTS / WordPress 5.4.2

# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply
# 29/11 2020: WordPress Plugin Security team contacted
# 20/12 2020: Vulnerability fixed


##################################
Path Traversal and DoS
##################################


# 1. Description

The "Folder" tab under "Publications" is vulnerable to path traversal and exposes information not stored on the web server. The user can gain information regarding images stored in, for example, home directories. The vulnerable code is in the utils.php file, which uses readdir().


# 2. Proof of Concept (PoC)

Enter the payload into the "Folder" input field:
../../../../../../../../../home/erik

However, if the web server attempts to open a folder without read access, the function will run in an infinite loop. For example:
../../../../../../../../../root

The web server will execute the code in an infinite loop and store massive amounts of data in the error.log file until the hard drive is full. The import Folder feature does not work anymore after trying to open directories without read permission when using path traversal techniques. Apache error.log file output:

[Fri Jul 24 20:45:43.739704 2020] [:error] [pid 3516] [client 192.168.0.51:47892] PHP Warning: readdir() expects parameter 1 to be resource, boolean given in /var/www/wordpress/wp-content/plugins/digital-publications-by-supsystic/classes/utils.php on line 137, referer: http://192.168.0.49/wp-admin/term.php?taxonomy=dps_book&tag_ID=16&post_type=post&wp_http_referer=%2Fwp-admin%2Fedit-tags.php%3Ftaxonomy%3Ddps_book



##################################
Stored XSS
##################################


# 1. Description

When adding a new publication under the section "Publications", all values such as Area Width, Publication Width and so on are vulnerable to stored XSS. It is possible to store code in all input fields as the code does not sanitize any user input.


# 2. Proof of Concept (PoC)

Enter the following payload into any input field: "><script>alert(1)</script><!--'
The payload is stored in the publication details and will be executed whenever the user views the "Publications" page or edits a publication.

Login or Register to add favorites

File Archive:

February 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    33 Files
  • 2
    Feb 2nd
    30 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    8 Files
  • 5
    Feb 5th
    11 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    1 Files
  • 8
    Feb 8th
    37 Files
  • 9
    Feb 9th
    15 Files
  • 10
    Feb 10th
    11 Files
  • 11
    Feb 11th
    26 Files
  • 12
    Feb 12th
    8 Files
  • 13
    Feb 13th
    1 Files
  • 14
    Feb 14th
    1 Files
  • 15
    Feb 15th
    9 Files
  • 16
    Feb 16th
    33 Files
  • 17
    Feb 17th
    6 Files
  • 18
    Feb 18th
    10 Files
  • 19
    Feb 19th
    20 Files
  • 20
    Feb 20th
    1 Files
  • 21
    Feb 21st
    1 Files
  • 22
    Feb 22nd
    17 Files
  • 23
    Feb 23rd
    15 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close