From 8e5b315870b0eca67886a4339d684030f2e80b62 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 2 May 2018 05:01:56 +0000 Subject: [PATCH] DB: 2018-05-02 1 changes to exploits/shellcodes macOS 10.13.2 - Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules Apple macOS 10.13.2 - Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules Apple macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules Nagios XI 5.2.[6-9]_ 5.3_ 5.4 - Chained Remote Root Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root WordPress Plugin Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting --- exploits/php/webapps/44563.txt | 44 ++++++++++++++++++++++++++++++++++ files_exploits.csv | 7 +++--- 2 files changed, 48 insertions(+), 3 deletions(-) create mode 100644 exploits/php/webapps/44563.txt diff --git a/exploits/php/webapps/44563.txt b/exploits/php/webapps/44563.txt new file mode 100644 index 000000000..457b4a835 --- /dev/null +++ b/exploits/php/webapps/44563.txt @@ -0,0 +1,44 @@ +# Exploit Title: Wordpress Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting +# Date: 2018-04-20 +# Exploit Author: B0UG +# Vendor Homepage: http://www.jameskoussertari.co.uk/ +# Software Link: https://en-gb.wordpress.org/plugins/responsive-cookie-consent/ +# Version: Tested on version 1.5 / 1.6 /1.7 (older versions may also be affected) +# Tested on: WordPress +# Category : Webapps +# CVE: CVE-2018-10309 + +#I. VULNERABILITY + +Authenticated Persistent Cross-Site Scripting + +#II. BACKGROUND +Responsive Cookie Consent is open source software kindly developed by James Koussertari to display cookie consent notifications on a WordPress website. + +#III. DESCRIPTION +A authenticated persistent cross-site scripting vulnerability has been found in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in the victim's browser when they visit the web site. + +#IV. PROOF OF CONCEPT +1) Access WordPress control panel. +2) Navigate to the Responsive Cookie Consent plugin page. +3) Select one of the input fields. For example, "Cookie Bar Border Bottom Size". +4) Insert the script you wish to inject. +5) Save the plugin settings. +6) Injected script will run in the victim's browser. Depending on which input field you inserted the script, the script may also run everytime you load the Responsive Cookie Consent plugin page. + +#V. IMPACT +An attacker can execute malicious code in a victim's browser to perform various activities such as stealing cookies, session tokens, credentials and personal data amongst others. + +#VI. SYSTEMS AFFECTED +WordPress websites running "Responsive Cookie Consent" plugin version 1.5 (older versions may also be affected). + +#VII. REMEDIATION +Update to the latest version available. Implement a web application such as Wordfence. + +#VIII. DISCLOSURE TIMELINE +#February 8, 2018 1: Vulnerability identified. +#February 8, 2018 2: Informed developer of the vulnerability. +#February 8, 2018 2: Developer acknowledged the vulnerability. +#February 10, 2018 2: Developer issued a security patch. +#February 12, 2018 2: Informed developer of further vulnerabilities. +#February 13, 2018 2: Developer issued a further two security patches. \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 68d4f5612..64c742a22 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -5955,8 +5955,8 @@ id,file,description,date,author,type,platform,port 44540,exploits/multiple/dos/44540.js,"Chrome V8 JIT - 'AwaitedPromise' Update Bug",2018-04-25,"Google Security Research",dos,multiple, 44541,exploits/multiple/dos/44541.js,"Chrome V8 JIT - Arrow Function Scope Fixing Bug",2018-04-25,"Google Security Research",dos,multiple, 44558,exploits/windows/dos/44558.py,"Navicat < 12.0.27 - Oracle Connection Overflow",2018-04-30,"Kevin McGuigan",dos,windows, -44561,exploits/macos/dos/44561.txt,"macOS 10.13.2 - Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules",2018-04-30,"Google Security Research",dos,macos, -44562,exploits/multiple/dos/44562.c,"macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules",2018-04-30,"Google Security Research",dos,multiple, +44561,exploits/macos/dos/44561.txt,"Apple macOS 10.13.2 - Double mach_port_deallocate in kextd due to Failure to Comply with MIG Ownership Rules",2018-04-30,"Google Security Research",dos,macos, +44562,exploits/multiple/dos/44562.c,"Apple macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules",2018-04-30,"Google Security Research",dos,multiple, 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux, 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris, 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux, @@ -39247,4 +39247,5 @@ id,file,description,date,author,type,platform,port 44550,exploits/hardware/webapps/44550.txt,"TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Unauthenticated Remote Reboot",2018-04-26,Wadeek,webapps,hardware, 44551,exploits/php/webapps/44551.txt,"Frog CMS 0.9.5 - Persistent Cross-Site Scripting",2018-04-26,"Wenming Jiang",webapps,php,80 44559,exploits/php/webapps/44559.txt,"WordPress Plugin Form Maker 1.12.20 - CSV Injection",2018-04-30,"Sairam Jetty",webapps,php, -44560,exploits/php/webapps/44560.py,"Nagios XI 5.2.[6-9]_ 5.3_ 5.4 - Chained Remote Root",2018-04-30,"Jared Arave",webapps,php, +44560,exploits/php/webapps/44560.py,"Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root",2018-04-30,"Jared Arave",webapps,php, +44563,exploits/php/webapps/44563.txt,"WordPress Plugin Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting",2018-05-01,B0UG,webapps,php,