bugtraq - Soundy Background Music XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <56E428E1.6080901@gmail.com>
Date: Sat, 12 Mar 2016 20:04:09 +0530
From: Rahul Pratap Singh <techno.rps@...il.com>
To: bugtraq@...urityfocus.com
Subject: Soundy Background Music XSS Vulnerability

## FULL DISCLOSURE
 
#Product : Soundy Background Music
#Exploit Author : Rahul Pratap Singh
#Version : 3.1
#Home page Link : https://wordpress.org/plugins/soundy-background-music/
#Website : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94
#Date : 12/3/2016

XSS Vulnerability:

----------------------------------------
Description:
----------------------------------------
"war_soundy_audio_volume" parameter is not sanitized that leads to
Reflected XSS.

----------------------------------------
Vulnerable Code:
----------------------------------------

soundy.php
 
1462-1473
 
if( $audio_volume_def == 'default' )
{
$audio_volume = 'default';
}
else
{
$audio_volume = $_POST[ 'war_soundy_audio_volume' ];
}
 
update_post_meta( $post_id,
                 'war_soundy_audio_volume',
                 $audio_volume );
                
----------------------------------------
POC:
----------------------------------------
https://0x62626262.files.wordpress.com/2016/03/soundy_background_music_xss.png

Fix:
Update to 3.2

Vulnerability Disclosure Timeline:
→ March  3, 2016  – Bug discovered, initial report to WordPress
→ March  7, 2016  – No response, Report sent again.
→ March  8, 2016  – WordPress response, plugin taken down
→ March 10, 2016  – Vendor deployed a patch

#######################################
#CTG SECURITY SOLUTIONS       #
#www.ctgsecuritysolutions.com  #
#######################################

Pub Ref:
https://wordpress.org/plugins/soundy-background-music/changelog/

Download attachment "0x9ACF7D5F.asc" of type "application/pgp-keys" (9748 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)