# Exploit Title: Word Press Photo Plus, Photo Search XSS/CSRF Vulnerability # Google Dork: # Date: 29/12/12 # Exploit Author: k3170makan # Vendor Homepage: http://wordpress.org/extend/plugins/wp-photo-album-plus/ # Software Link: http://wordpress.org/extend/plugins/wp-photo-album-plus/ # Version: 4.8.11 # Tested on: Ubuntu 10.04 Word Press Photo Plus plugin suffers from a XSS/CSRF via Vulnerability in the "Search Photos" function Code: extract from wp-photo-album-plus.php, in widget function -------------------------------------------------------------------------------------------------------------------------------- 42

44 45 46 47

--------------------------------------------------------------------------------------------------------------------------------- The above code fails to sanitize the $wppa['searchstring'] variable, allowing attacks to inject harmfull HTML elements and JavaScript code. Submissions to this form can also be made from any domain, which actually aids in the exploitation of the vulnerability thus this is classified as a CSRF Vulnerability Exploit Code: The exploit requires an attacker to forge a post request to this form, this can be done by using the following html page -------------------------------------------------------------------------------------------------------------------------------- 1 2 3 4 5 6

7 12 13 -------------------------------------------------------------------------------------------------------------------------------- [photo search page path] can be obtained by reading the path set in the original photo search form attributes -- Makan/>