WordPress Responsive Thumbnail Slider Plugin 1.0 - XSS / Arbitrary File Upload Vulnerabilities

<!--
# Exploit Title: Wordpress Responsive Thumbnail Slider Stored XSS
# Date: 2015/8/29
# Exploit Author: Arash Khazaei
# Vendor Homepage: https://wordpress.org/plugins/wp-responsive-thumbnail-slider/
# Software Link: https://downloads.wordpress.org/plugin/wp-responsive-thumbnail-slider.zip
# Version: 1.0
# Tested on: Kali , Iceweasel Browser
# CVE : N/A
# Contact : http://twitter.com/0xClay

# Intrduction :

# Wordpress Responsive Thumbnail Slider Plugin iS A With 6000+ Active Install
# And Suffer From A Stored XSS Vulnerability In Image Title Section .
# Authors , Editors And Of Course Administrators This Vulnerability To Harm WebSite .
Exploit :

To Exploit This Vulnerability When Adding Image With This Plugin
In Title Section Place Your JavaScript Code .


# Vulnerable Code In wp-responsive-images-thumbnail-slider.php file in line [816]:
-->
<tr valign="top" >
<td class="alignCenter check-column" data-title="Select Record" ><input type="checkbox" value="<?php echo $row['id'] ?>" name="thumbnails[]"></td>
<!-- Vulnerable Code --> <td data-title="Title" ><strong><?php echo stripslashes($row['title']) ?></strong></td>
<td data-title="Image" class="alignCenter">
<img src="<?php echo $outputimgmain;?>" style="width:50px" height="50px"/>
</tr>
<!--
To Patch This Vulnerability :
-->
<tr valign="top" >
<td class="alignCenter check-column" data-title="Select Record" ><input type="checkbox" value="<?php echo $row['id'] ?>" name="thumbnails[]"></td>
<!-- Patched Code --> <td data-title="Title" ><strong><?php echo htmlspecialchars($row['title']) ?></strong></td>
<td data-title="Image" class="alignCenter">
<img src="<?php echo $outputimgmain;?>" style="width:50px" height="50px"/>
</tr>


# Intrduction :
 
# Wordpress Responsive Thumbnail Slider Plugin iS A With 6000+ Active
Install
# And Suffer From A File Upload Vulnerability Allow Attacker Upload Shell
As A Image .
# Authors , Editors And Of Course Administrators This Vulnerability To Harm
WebSite .
 
# POC :
 
# For Exploiting This Vulnerability :
 
# Go To Add Image Section And Upload File By Self Plugin Uploader
# Then Upload File With Double Extension Image
# And By Using A BurpSuite Or Tamper Data Change The File Name From
Shell.php.jpg To Shell.php
# And Shell Is Uploaded . :)

#  0day.today [2018-04-11]  #