WordPress Zingiri Web Shop 2.4.0 Cross Site Scripting

`##############################################################################  
Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities  
  
author...............: Mehmet Ince  
twitte...............: https://twitter.com/#!/mmetince  
mail.................: [email protected]  
software link........: http://www.zingiri.com  
affected versions....: tested on 2.3.0 and 2.4.0  
# Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS  
Vulnerabilities  
# Google Dork:  
# Date: 26 Apr 2012  
# Author: Mehmet INCE  
# Software Link:  
http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.0.zip  
# Version: 2.4.0 and older.  
# Tested on: version of 2.3.0 and 2.4.0 with Ubuntu 11.10 Server with  
Firefox browser.  
##############################################################################  
/*  
## BASIC XSS  
PS: Exploitable without Authentication  
  
plugins/zingiri-web-shop/zing.inc.php  
  
line at 401.  
  
if ($process=='content' && $page!='ajax' && $page!='downldr') echo '<div  
class="zing_ws_page" id="zing_ws_'.$_GET['page'].'">';  
  
Exploit:  
http://localhost/wordpress/?page=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E  
  
'page' variable isn't properly sanitized before being used.  
  
  
## STORED XSS  
PS: Attacker should be logged for exploit.  
./fws/pages-front/onecheckout.php  
  
line 27-29  
if (!empty($_POST['notes'])) {  
$notes=$_POST['notes'];  
}  
  
and line 348  
<textarea name="notes" rows="5" style="width: 100%"><?php echo  
$notes;?></textarea><br />  
  
'notes' variable isn't properly sanitized before being used.  
  
That's very basic XSS vulnerabilities. But you dont need use fishing attack  
to target webpage's administrator. That application insert datas to  
database with that form. After your malicious code posted up, your  
javascrip code inserted to database with $_POST['notes'] variable. When  
administrator wanna see list of ordered items list. Javascript codes will  
come from database and start working on Authenticated admin user side.  
After that You can use browser keylogger with BT5 tools or can usee cookie  
grabber.  
*/  
  
step 1: Login to wordpress.  
  
step 2: Go to "Shop" menu. It's should be stay at banner.  
  
http://6.6.6.102/wordpress/?page_id=14  
  
step 3: Than you'll see list ot items. Click one of them.  
  
http://6.6.6.102/wordpress/?page=details&prod=2&cat=1&page_id=14  
  
step 4: You can pass that form action. That wont be problem..! Click to  
"Order" button.  
  
step 5: There is confirmation about the Shopping. Click "checkout" to pass  
that page.  
  
step 6: It's final stage. Put you javascript payload to "Additional  
comments/questions" form. After you click checkout button, that form will  
get all of these input data with POST method.  
  
step 7: Click to "Checkout"  
  
`