full-disclosure - Event Easy Calendar 1.0.0 WP plugin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20130907075853.AE42860191@smtp.hushmail.com>
Date: Sat, 07 Sep 2013 09:58:53 +0200
From: "Adéla Goldová" <roguecoder@...h.com>
To: "full-disclosure" <full-disclosure@...ts.grok.org.uk>
Subject: Event Easy Calendar 1.0.0 WP plugin

Details
========================
Application: Event Easy Calendar
Version: 1.0.0
Type: WordPress Plugin
Vendor: Adamson ( http://profiles.wordpress.org/adamson/ )
Url: http://wordpress.org/plugins/event-easy-calendar/
Vulnerability:
- Improper Input Validation (CWE-20)
- Cross-Site Scripting (CWE-79)
- Cross-Site Request Forgery (CWE-352)

Description
========================
Events Easy Calendar will enable WordPress sites to manage all their bookings and appointments.

Vulnerability
========================
This plugin contains CSRF on all forms and some are also vulnerable to XSS. This entire plugin can be remotely controlled by crafting arbitrary payloads and send a malicious link to a site admin. By doing this you can create and update customers, create new services/cupons, change settings, enable reminders/auto approval, delete all bookings, etc. It's also possible to modify the PayPal recipient email address, so that all payments are sent to the attacker instead of the service provider. The cost of any services are also easily modified.

Solution
========================
No fix by vendor at this point. Remove the plugin from your WordPress installation.

Timeline
========================
2013-08-15 Wrote a comment pointing out to the vendor that there was some vulnerabilities and that a report would be made the same day. Comment was deleted.
2013-08-15 Contacted the vendor through the plugin support section on wordpress.org, where I requested a valid email to send the report to.
2013-08-16 Third and last message sent to vendor in an attempt to get a valid email address to send the report to
2013-08-16 An email address were provided by the plugin developer
2013-08-25 Vulnerability details were sent to the provided email address
2013-09-02 Details were sent to plugins@...dpress.org
2013-09-05 Confirmation email recieved from Wordpress
2013-09-05 Plugin has been removed from the plugin directory
2013-09-07 Publicly disclosed

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/