WordPress Dexs PM System Cross Site Scripting

`===============================================================================  
| |  
____ _ __  
___ __ __/ / /__ ___ ______ ______(_) /___ __  
/ _ \/ // / / (_-</ -_) __/ // / __/ / __/ // /  
/_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, /  
/___/ team  
  
PUBLIC SECURITY ADVISORY  
| |  
===============================================================================  
  
  
TITLE  
=====  
  
Dexs PM System - Authenticated Persistent Cross Site Scripting Vulnerability  
  
  
AUTHOR  
======  
  
TheXero  
  
  
DATE  
====  
  
10/14/2013  
  
VENDOR  
======  
  
Sam Brishes - http://www.pytes.net/  
  
  
AFFECTED PRODUCT  
================  
  
Dexs PM System Wordpress Plugin Version 1.0.1 possibly earlier  
  
  
VULNERABILITY CLASS  
===================  
  
Cross-Site Scripting  
  
  
DESCRIPTION  
===========  
  
  
Dexs PM System suffers from a persistent Cross-Site Scripting vulnerability  
when sending a message as an authenticated user. An account of at least  
subscriber status is requested to exploit this vulnerability.  
This vulnerability exists due to a lack of input validation and output  
sanitization of the subject paramater.  
  
  
PROOF OF CONCEPT  
================  
  
Enter the following into the subject field when sending a message to another  
user.  
  
--- SNIP ---  
  
XSS<script>alert('xss');</script>  
  
--- SNIP ---  
  
If the message has been sent successfully a alert diolog will apear containing  
xss when an user checks there message in the dashboard.  
  
  
IMPACT  
======  
  
An attacker could potentially hijack session authentication tokes of remote  
users and leverage the vulnerability to increase the attack vector to the  
underlying software and operating system of the victim.  
  
  
THREAT LEVEL  
============  
  
High  
  
  
STATUS  
======  
  
0day  
  
  
DISCLAIMER  
==========  
  
nullsecurity.net hereby emphasize, that the information which is published here  
are for education purposes only. nullsecurity.net does not take any  
responsibility for any abuse or misusage!  
  
`