lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 11 May 2017 12:34:48 +0200
From: DefenseCode <>
Subject: [FD] DefenseCode ThunderScan SAST Advisory: WordPress Tracking Code
 Manager Plugin Multiple Security Vulnerabilities

           DefenseCode ThunderScan SAST Advisory
          WordPress Tracking Code Manager Plugin
            Multiple Security Vulnerabilities

Advisory ID: DC-2017-01-020
Advisory Title: WordPress Tracking Code Manager Plugin Multiple
Advisory URL:
Software: WordPress Tracking Code Manager
Software Language: PHP
Version: 1.11.1 and below
Vendor Status: Vendor contacted
Release Date: 2017-05-10
Risk: Medium

1. General Overview
During the security audit of Tracking Code Manager plugin for
WordPress CMS, multiple vulnerabilities were discovered using
DefenseCode ThunderScan application source code security analysis

More information about ThunderScan is available at URL:

2. Software Overview
According to the developers, Tracking Code Manager is a plugin to
manage all your tracking code and conversion pixels, simply.
Compatible with Facebook Ads, Google Adwords, WooCommerce, Easy
Digital Downloads, WP eCommerce.

It has more than 40,000 downloads on


3. Brief Vulnerability Description
During the security analysis, ThunderScan discovered Cross-Site
Scripting and remote Denial of Service vulnerabilities in Tracking
Code Manager plugin. Denial of Service requires only one visit to a
specific URL and whole WordPress becomes completely unresponsive until
restart. DoS is based upon the ability of the user to select and call
a function of it's choice (while safisfying specific conditions). By
making a recursive call to the function that handles the request
(tcmp_do_action()) DoS can easily be accomplished.

Both vulnerabilities can be found in the settings section of the
plugin, and can be remotely triggered due to missing nonce token and
validation. Since the DoS vulnerability relies on GET requests, is
missing the nonce token, the vulnerability is also directly exposed to
attack vectors such as Cross Site request forgery (CSRF).

DoS vulnerability was confirmed on windows OS.

3.1 Cross-Site Scripting
  URL Parameter:    tcmp_action
  Vulnerable URL:<script>alert(1)</script>
3.2. Denial of Service
  Function:            tcmp_do_action()
  Vulnerable URL:

4. Solution
Vendor should resolve the security issues in next release. All users
are strongly advised to update WordPress Tracking Code Manager plugin
to the latest available version as soon as the vendor releases an

5. Credits
Discovered with DefenseCode ThunderScan Source Code Security Analyzer
 by Neven Biruski

6. Disclosure Timeline
04/04/2017    Vendor contacted
07/04/2017    Vendor responded: "We will fix it in the next update"
10/05/2017    Advisory released to the public

7. About DefenseCode
DefenseCode L.L.C. delivers products and services designed to analyze
and test web, desktop and mobile applications for security

DefenseCode ThunderScan is a SAST (Static Application Security
Testing, WhiteBox Testing) solution for performing extensive security
audits of application source code. ThunderScan SAST performs fast and
accurate analyses of large and complex source code projects delivering
precise results and low false positive rate.

DefenseCode WebScanner is a DAST (Dynamic Application Security
Testing, BlackBox Testing) solution for comprehensive security audits
of active web applications. WebScanner will test a website's security
by carrying out a large number of attacks using the most advanced
techniques, just as a real attacker would.

Subscribe for free software trial on our website

E-mail: defensecode[at]


Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists