WordPress Plugin Quick Contact Form 6.0 – Persistent Cross-Site Scripting

• Exploit Database
• 109 阅读

• 作者： Zy0d0x
  日期： 2013-10-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/28808/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97

  =============================================================================== | | ____ _ __ _____ __/ / /__ ___ ______ ______(_) /___ __ / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / /___/ team   PUBLIC SECURITY ADVISORY | | ===============================================================================     TITLE =====   Quick Contact Form - Persistent Cross Site Scripting Vulnerability     AUTHOR ======   Zy0d0x     DATE ====   10/06/2013   VENDOR ======   Quick Plugins - http://quick-plugins.com/     AFFECTED PRODUCT ================   Quick Contact FormWordPress Plugin Version 6.0 possibly earlier     VULNERABILITY CLASS ===================   Cross-Site Scripting     DESCRIPTION ===========     Quick Contact Form suffers from a persistent Cross-Site Scripting vulnerability due to a lack of input validation and output sanitization of the qcfname4 paramater. Other input fields are also effective to reflective cross site scripting.     PROOF OF CONCEPT ================   Enter the following into the field where Quick Contact Form requests a Message.   --- SNIP ---   "><script>alert(String.fromCharCode(90,121,48,100,48,120))</script><   --- SNIP ---   If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard.     IMPACT ======   An attacker could potentially hijack session authentication tokes of remote users and leverage the vulnerability to increase the attack vector to the underlying software and operating system of the victim.     THREAT LEVEL ============   High     STATUS ======   Fixed update to version 6.1     DISCLAIMER ==========   nullsecurity.net hereby emphasize, that the information which is published here are for education purposes only. nullsecurity.net does not take any responsibility for any abuse or misusage!