bugtraq - [IBliss Security Advisory] Cross-site scripting ( XSS ) in Bradesco gateway wordpress plugin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <524069B2.8000304@ibliss.com.br>
Date: Mon, 23 Sep 2013 13:17:54 -0300
From: Alexandro Silva <alexos@...iss.com.br>
To: bugtraq@...urityfocus.com
Subject: [IBliss Security Advisory] Cross-site scripting ( XSS ) in Bradesco
 gateway wordpress plugin

[ Bradesco Gateway Wordpress plugin Cross-site scripting ( XSS ) ]

[ Vendor product description]
Bradesco Gateway for the WP-Ecommerce plugin.

[ Bug Description ]

Cross-site scripting (XSS) vulnerability in falha.php in the Bradesco
Gateway plugin before 2.0 for WordPress allows remote attackers to
inject arbitrary web script or HTML.


[ History ]

Advisory sent to vendor on 09/04/2013
Contact vendor again on 09/13/2013
Contact vendor again on 09/20/2013
Advisory sent to Wordpress plugin team on 09/20/2013

[ Impact ]
HIGH

[ Afected Version ]

2.0

[ Vendor Reply ]

No Vendor team response.
No Wordpress plugin response.

[ CVE Reference ]

CVE-2013-5916

[ PoC ]

Payload: http://[host]/>
/wordpress/wp-content/plugins/wp-e-commerce/wpsc-merchants/bradesco-gateway/falha.php?1%3CScRiPt%3Eprompt%28%27XSS%27%29%3C/ScRiPt%3E

[ References ]

[1] Bradesco-gateway -
http://plugins.svn.wordpress.org/bradesco-gateway/trunk/bradesco-gateway.php
[2] Owasp Cross-site scripting -
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/

--------------------------------------------
iBliss Segurança e Inteligência - Sponsor: Alexandro Silva - Alexos

alexos (at) ibliss.com (dot) br [email concealed]