[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAOmn9FQVJ7QQf1rk4v8P07UoRpW-=L+k24dKCVP61fmpD_32mA@mail.gmail.com>
Date: Sat, 16 Apr 2016 13:59:06 +0530
From: shravan kumar <cor3sm4sh3r@...il.com>
To: oss-security@...ts.openwall.com
Subject: Reflected XSS Vulnerability in Wordpress Custom-metas plugin 1.5.1
Hello ,
I would like to disclose a XSS vulnerability in Custom-metas plugin version
1.5.1 .
The Plugin can be found at https://wordpress.org/plugins/custom-metas/
Reproduction steps:
- Install the plugin custom-metas
- Log in to wp-admin as administrator (tested on firefox)
- Pass the XSS payload as GET parameter to the
/wp-admin/admin.php?page=custom-metas&paged=<XSS payload here>
- example
http://targetip/WPinstallationdir/wp-admin/admin.php?page=custom-metas&paged=
"><script>alert(1);</script>
- you will see a alert box.
Technical details:
This vulnerability is due to display of unsanitized GET parameters, which
are directly displayed on the page with-out any filters.
The vulnerable page is
/wp-content/plugins/custom-metas/tpl/meta-data-form-multiple.php
The Code responsible for the vulnerability is
LINE 10
$currentPageNo = ( isset($_GET['paged']) && $_GET['paged'] != "")?
$_GET['paged']:1;
the currentPageNo variable is set using $_GET['paged'] .
It is then displayed in unsafe manner i.e without any filters. in following
line of code
LINE 43
<input type="text" size="2" value="<?php echo $currentPageNo;?>"
name="paged" title="Current page" id="postCurrent" class="current-page" />
of <span class="total-pages"><?php echo $tPostNumCount; ?></span>
--
Shravan Kumar
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
