Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:31872
HistoryMar 23, 2015 - 12:00 a.m.

Stored XSS Vulnerability in ADPlugg Wordpress Plugin

2015-03-2300:00:00
vulners.com
19

=====================================================
Stored XSS Vulnerability in ADPlugg Wordpress Plugin

. contents:: Table Of Content

Overview

  • Title :Stored XSS Vulnerability in ADPlugg Wordpress Plugin
  • Author: Kaustubh G. Padwad
  • Plugin Homepage: https://wordpress.org/plugins/adplugg/
  • Severity: Medium
  • Version Affected: 1.1.33 and mostly prior to it
  • Version Tested : 1.1.33
  • version patched: 1.1.34

Description

Vulnerable Parameter

  • Access Code

About Vulnerability

This plugin is vulnerable to a Stored cross site scripting vulnerability,This issue was exploited when administrator users with access to AdPlugg Setting in wordpress Access code parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.

Vulnerability Class

Cross Site Scripting (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)

Steps to Reproduce: (POC)

After installing the plugin

  • Goto settings –> AdPlugg
  • Put This payload in Access Code "><script>alert(document.cookie)</script>
  • Click on the Save Changes you will see XSS in action
  • Reload the page or re navigate to page to make sure its stored

Mitigation

Update to Version 1.1.34

Change Log

https://wordpress.org/plugins/adplugg/changelog/

Disclosure

18-February-2015 reported to developer
19-February-2015 Developer acknodlage the Bug
19-February-2015 Developer Patched the Bug and Push update
21-February-2015 Public Discloser

credits