Wordpress Quick Contact Form Plugin 6.0 - Persistent XSS

TITLE
=====
 
Quick Contact Form - Persistent Cross Site Scripting Vulnerability
 
AUTHOR
======
 
Zy0d0x
 
DATE
====
 
10/06/2013
 
VENDOR
======
 
Quick Plugins - http://quick-plugins.com/
 
 AFFECTED PRODUCT
================
 
Quick Contact Form  Wordpress Plugin Version 6.0 possibly earlier
  
VULNERABILITY CLASS
===================
 
Cross-Site Scripting
 
 DESCRIPTION
===========
  
Quick Contact Form suffers from a persistent Cross-Site Scripting vulnerability due to a lack
of input validation and output sanitization of the qcfname4 paramater.
Other input fields are also effective to reflective cross site scripting.
  
PROOF OF CONCEPT
================
 
Enter the following into the field where Quick Contact Form requests a Message.
 
--- SNIP ---
 
"><script>alert(String.fromCharCode(90,121,48,100,48,120))</script><
 
--- SNIP ---
 
If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard.
  
IMPACT
======
 
An attacker could potentially hijack session authentication tokes of remote users and leverage the
vulnerability to increase the attack vector to the underlying software and operating system of the victim.
  
THREAT LEVEL
============
 
High
  
STATUS
======
 
Fixed update to version 6.1

#  0day.today [2018-03-12]  #