full-disclosure - XSS, CSRF and AFU vulnerabilities in Organizer for WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <009201cd230c$2d1eb7e0$0100a8c0@ml>
Date: Wed, 25 Apr 2012 20:51:24 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: XSS,
	CSRF and AFU vulnerabilities in Organizer for WordPress

Hello list!

I want to warn you about multiple security vulnerabilities in plugin 
Organizer for WordPress. This is the second in series of advisories 
concerning vulnerabilities in this plugin.

These are Cross-Site Scripting (reflected and persistent), Cross-Site 
Request Forgery and Arbitrary File Upload (Code Execution) vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are Organizer 1.2.1 and previous versions.

As answered me the developer of the plugin, he doesn't support it anymore 
and will not be fixing any vulnerabilities in it.

----------
Details:
----------

XSS (WASC-08):

http://site/wp-admin/admin.php?page=organizer/page/users.php&edit_id=%3Cscript%3Ealert(document.cookie)%3C/script%3E

XSS (Persistent) (WASC-08):

Exploit:

http://websecurity.com.ua/uploads/2012/Organizer%20XSS-2.html

Code will execute at the page users.php of the plugin.

CSRF (WASC-09):

Via attack on function Add/Edit User Setting (which combined into the same 
POST request) it's possible to add and edit settings.

POST request at page 
http://site/wp-admin/admin.php?page=organizer/page/users.php. Similarly to 
above exploit for XSS.

Via attack on function Delete User Setting it's possible to delete settings.

http://site/wp-admin/admin.php?page=organizer/page/users.php&delete_id=admin

Arbitrary File Upload (Code Execution) (WASC-31):

It's possible to upload arbitrary files with code execution (php files). 
Because in field "File extensions allowed" it's possible to set extensions 
of scripts, such as "php".

This will allow to upload to the server and execute arbitrary scripts. 
Besides attacking admin via above-mentioned CSRF vulnerability for changing 
of the settings (or getting access to admin account for this), the 
Insufficient Authorization vulnerability (described in the third advisory) 
also can be used for this (in the presence of account even with lowest 
rights as Subscriber).

------------
Timeline:
------------

2012.04.15 - informed the developer about previous vulnerabilities.
2012.04.16 - announced at my site (http://websecurity.com.ua/5786/).
2012.04.17 - the developer answered, that he didn't support the plugin 
anymore.
2012.04.17 - additionally informed the developer about new vulnerabilities.
2012.04.24 - disclosed at my site.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/