Date: Sat, 16 Apr 2016 13:59:06 +0530 From: shravan kumar <cor3sm4sh3r@...il.com> To: oss-security@...ts.openwall.com Subject: Reflected XSS Vulnerability in Wordpress Custom-metas plugin 1.5.1 Hello , I would like to disclose a XSS vulnerability in Custom-metas plugin version 1.5.1 . The Plugin can be found at https://wordpress.org/plugins/custom-metas/ Reproduction steps: - Install the plugin custom-metas - Log in to wp-admin as administrator (tested on firefox) - Pass the XSS payload as GET parameter to the /wp-admin/admin.php?page=custom-metas&paged=<XSS payload here> - example http://targetip/WPinstallationdir/wp-admin/admin.php?page=custom-metas&paged= "><script>alert(1);</script> - you will see a alert box. Technical details: This vulnerability is due to display of unsanitized GET parameters, which are directly displayed on the page with-out any filters. The vulnerable page is /wp-content/plugins/custom-metas/tpl/meta-data-form-multiple.php The Code responsible for the vulnerability is LINE 10 $currentPageNo = ( isset($_GET['paged']) && $_GET['paged'] != "")? $_GET['paged']:1; the currentPageNo variable is set using $_GET['paged'] . It is then displayed in unsafe manner i.e without any filters. in following line of code LINE 43 <input type="text" size="2" value="<?php echo $currentPageNo;?>" name="paged" title="Current page" id="postCurrent" class="current-page" /> of <span class="total-pages"><?php echo $tPostNumCount; ?></span> -- Shravan Kumar
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.