WordPress Infocus Theme Cross Site Scripting

`Infocus Theme DOM Based XSS  
  
Details  
=======  
Product: Infocus Theme DOM Based XSS  
Security-Risk: Moderate  
Remote-Exploit: yes  
Company: RHAINFOSEC  
Website: http://services.rafayhackingarticles.net  
Vendor-URL:  
http://themeforest.net/item/infocus-powerful-professional-wordpress-theme/85486  
Vendor-Status: informed  
Advisory-Status: published  
  
Credits  
=======  
Discovered By: Rafay Baloch  
http://rhainfosec.com  
  
Description  
========  
The worpdress theme "Infocus" appears to use vulnerable instance of pretty  
photo plugin that  
is prone to a DOM based xss, unlike other XSS, dom based xss occurs on the  
client side, thus  
leaving all the server side defenses worthlesss. The issue occurs inside  
the client side javascripts  
where the source (User supplied input) is passed through a vulnerable sink  
(Anything that creates/writes) without sanitsing/escaping the user supplied  
input  
  
More Details  
=========  
  
  
Line 623: hashIndex = getHashtag();  
  
Inside the line 623, we see a variable hashIndex which calls th e  
getHashtag() function, which is responsible for returning the user  
supplied values after the hash.  
  
  
Let's take a look at teh getHashtag() function:  
  
getHashtag()  
{  
url=location.href;hashtag=(url.indexOf('#!')!=-1)?decodeURI  
(url.substring(url.indexOf('#!')+2,url.length)):false;return  
hashtag;};  
  
The function getHashtag() is used for returning the user supplied input,  
the function also checks if the user input contains the hash bang and then  
returns the value.  
  
setTimeout(function()  
{  
$("a[rel^='" + hashRel + "']:eq(" + hashIndex + ")").trigger('click'); },  
50);  
  
Finally we have the above line which is responsible for the cause of the  
dom based xss, the $("a[rel^='" + hashRel + "']:eq(" + hashIndex + ")  
writes the user supplied input to the dom without sanitising the input.  
  
POC  
===  
  
http://target.com/#!%22%3E%3Cimg%20src=1%20onerror=prompt%280%29;%3E//  
  
The issue was fixed by sanitising the "hashrel" input before returning it  
to the user.  
  
hashIndex = parseInt(hashIndex);  
hashRel = hashRel.replace(/([ #;&,.+*~\':"!^$[\]()=>|\/])/g,'\\$1');  
  
  
References  
==========  
  
http://www.rafayhackingarticles.net/2013/05/kali-linux-dom-based-xss-writeup.html  
`