0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload
[I want to warn you about multiple security vulnerabilities in plugin Organizer for WordPress. This is the second in series of advisories concerning vulnerabilities in this plugin. These are Cross-Site Scripting (reflected and persistent), Cross-Site Request Forgery and Arbitrary File Upload (Code Execution) vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are Organizer 1.2.1 and previous versions. As answered me the developer of the plugin, he doesn't support it anymore and will not be fixing any vulnerabilities in it. ---------- Details: ---------- XSS (WASC-08): http://site/wp-admin/admin.php?page=organizer/page/users.php&edit_id=%3Cscript%3Ealert(document.cookie)%3C/script%3E XSS (Persistent) (WASC-08): Exploit: http://websecurity.com.ua/uploads/2012/Organizer%20XSS-2.html Code will execute at the page users.php of the plugin. CSRF (WASC-09): Via attack on function Add/Edit User Setting (which combined into the same POST request) it's possible to add and edit settings. POST request at page http://site/wp-admin/admin.php?page=organizer/page/users.php. Similarly to above exploit for XSS. Via attack on function Delete User Setting it's possible to delete settings. http://site/wp-admin/admin.php?page=organizer/page/users.php&delete_id=admin Arbitrary File Upload (Code Execution) (WASC-31): It's possible to upload arbitrary files with code execution (php files). Because in field "File extensions allowed" it's possible to set extensions of scripts, such as "php". This will allow to upload to the server and execute arbitrary scripts. Besides attacking admin via above-mentioned CSRF vulnerability for changing of the settings (or getting access to admin account for this), the Insufficient Authorization vulnerability (described in the third advisory) also can be used for this (in the presence of account even with lowest rights as Subscriber). ------------ Timeline: ------------ 2012.04.15 - informed the developer about previous vulnerabilities. 2012.04.16 - announced at my site (http://websecurity.com.ua/5786/). 2012.04.17 - the developer answered, that he didn't support the plugin anymore. 2012.04.17 - additionally informed the developer about new vulnerabilities. 2012.04.24 - disclosed at my site. Best wishes & regards, MustLive # 0day.today [2024-11-15] #