bugtraq - Tweet-wheel XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <571BBEC7.9010206@gmail.com>
Date: Sat, 23 Apr 2016 23:58:23 +0530
From: Rahul Pratap Singh <techno.rps@...il.com>
To: bugtraq@...urityfocus.com
Subject: Tweet-wheel XSS Vulnerability

## FULL DISCLOSURE

#Product :Tweet-wheel
#Exploit Author : Rahul Pratap Singh
#Version :1.0.3.2
#Home page Link : https://wordpress.org/plugins/tweet-wheel/
#Website : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94
#Date : 21/4/2016

XSS Vulnerability:

----------------------------------------
Description:
----------------------------------------
Following  parameters are not sanitized that leads to XSS Vulnerability.

consumer_key,consumer_secret,access_token,access_token_secret

----------------------------------------
Vulnerable Code:
----------------------------------------

File Name: testfiles/tweet-wheel/includes/views/auth.php
Found at line:34
<input style="width:400px" type="text" name="consumer_key" value="<?php
echo isset( $_POST['consumer_key'] ) ? $_POST['consumer_key'] : ''; ?>">
Found at line:40
<input style="width:400px" type="text" name="consumer_secret"
value="<?php echo isset( $_POST['consumer_secret'] ) ?
$_POST['consumer_secret'] : ''; ?>">
Found at line:46
<input style="width:400px" type="text" name="access_token" value="<?php
echo isset( $_POST['access_token'] ) ? $_POST['access_token'] : ''; ?>">
Found at line:52
<input style="width:400px" type="text" name="access_token_secret"
value="<?php echo isset( $_POST['access_token_secret'] ) ?
$_POST['access_token_secret'] : ''; ?>">

----------------------------------------

Fix:
Update to 1.0.4

Vulnerability Disclosure Timeline:
→ March 14, 2016  – Bug discovered, initial report to Vendor.
→ March 22, 2016  – No Response. Report sent again.
→ March 23, 2016  – WordPress Acknowledged.
→ April 21, 2016  – Full Disclosure.

Pub Ref:
https://0x62626262.wordpress.com/2016/04/21/tweet-wheel-xss-vulnerability/
https://wordpress.org/plugins/tweet-wheel/changelog/

Download attachment "0xE5D04434.asc" of type "application/pgp-keys" (61463 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)