WordPress Dosimple Theme 2.0 Cross Site Scripting Vulnerability

Document Title:
===============
Wordpress Theme Dosimple v2.0 - XSS Web Vulnerability


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a cross
site web vulnerability in the Wordpress Theme Dosimple v2.0 web-application.


Technical Details & Description:
================================
A non-persistent cross site scripting vulnerability has been discovered
in the official Wordpress Theme Dosimple v2.0 web-application.
The vulnerability allows remote attackers to inject own malicious script
codes with non-persistent attack vector to compromise browser to
web-application requests from the client-side.

The cross site scripting vulnerabilities are located in the `s`
parameter. The request method to inject the malicious script code is GET
and
the attack vector of the vulnerability is non-persistent on client-side.

Successful exploitation of the vulnerability results in session
hijacking, non-persistent phishing attacks, non-persistent external
redirects to malicious source and non-persistent manipulation of
affected application modules.

Request Method(s):
[+] GET

Vulnerable Parameter(s):
[+] s


Proof of Concept (PoC):
=======================
The non-persistent web vulnerability can be exploited by remote
attackers without user account with low user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.


PoC: Example
https://localhost:8080/?s=<[NON-PERSISTENT CROSS SITE SCRIPTING!]>


PoC: Exploitation
https://localhost:8080/?s='"><script>alert(document.cookie)<%2Fscript>


Reference(s):
http://gogoneXt.ye.vc/?s='"><script>alert(document.domain)<%2Fscript>
http://www.ndaXnndung.club/?s='"><script>alert(document.domain)<%2Fscript>
https://besthoXme-designideas.rhcloud.com/?s='"><script>alert(document.domain)<%2Fscript>
http://madmXaxuryroad.tk/?s='"><script>alert(document.domain)<%2Fscript>

#  0day.today [2020-07-20]  #