WordPress Plugin Dexs PM System – (Authenticated) Persistent Cross-Site Scripting

• Exploit Database
• 114 阅读

• 作者： TheXero
  日期： 2013-10-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/28970/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102

  =============================================================================== | | ____ _ __ _____ __/ / /__ ___ ______ ______(_) /___ __ / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / /___/ team   PUBLIC SECURITY ADVISORY | | ===============================================================================     TITLE =====   Dexs PM System - Authenticated Persistent Cross Site Scripting Vulnerability     AUTHOR ======   TheXero     DATE ====   10/14/2013   VENDOR ======   Sam Brishes - http://www.pytes.net/     AFFECTED PRODUCT ================   Dexs PM System WordPress Plugin Version 1.0.1 possibly earlier     VULNERABILITY CLASS ===================   Cross-Site Scripting     DESCRIPTION ===========     Dexs PM System suffers from a persistent Cross-Site Scripting vulnerability when sending a message as an authenticated user.An account of at least subscriber status is requested to exploit this vulnerability. This vulnerability exists due to a lack of input validation and output sanitization of the subject paramater.     PROOF OF CONCEPT ================   Enter the following into the subject field when sending a message to another user.   --- SNIP ---   XSS<script>alert(&apos;xss&apos;);</script>   --- SNIP ---   If the message has been sent successfully a alert diolog will apear containing xss when an user checks there message in the dashboard.     IMPACT ======   An attacker could potentially hijack session authentication tokes of remote users and leverage the vulnerability to increase the attack vector to the underlying software and operating system of the victim.     THREAT LEVEL ============   High     STATUS ======   0day     DISCLAIMER ==========   nullsecurity.net hereby emphasize, that the information which is published here are for education purposes only. nullsecurity.net does not take any responsibility for any abuse or misusage!