96 lines
No EOL
2.1 KiB
Text
96 lines
No EOL
2.1 KiB
Text
===============================================================================
|
|
| |
|
|
____ _ __
|
|
___ __ __/ / /__ ___ ______ ______(_) /___ __
|
|
/ _ \/ // / / (_-</ -_) __/ // / __/ / __/ // /
|
|
/_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, /
|
|
/___/ team
|
|
|
|
PUBLIC SECURITY ADVISORY
|
|
| |
|
|
===============================================================================
|
|
|
|
|
|
TITLE
|
|
=====
|
|
|
|
Quick Contact Form - Persistent Cross Site Scripting Vulnerability
|
|
|
|
|
|
AUTHOR
|
|
======
|
|
|
|
Zy0d0x
|
|
|
|
|
|
DATE
|
|
====
|
|
|
|
10/06/2013
|
|
|
|
VENDOR
|
|
======
|
|
|
|
Quick Plugins - http://quick-plugins.com/
|
|
|
|
|
|
AFFECTED PRODUCT
|
|
================
|
|
|
|
Quick Contact Form Wordpress Plugin Version 6.0 possibly earlier
|
|
|
|
|
|
VULNERABILITY CLASS
|
|
===================
|
|
|
|
Cross-Site Scripting
|
|
|
|
|
|
DESCRIPTION
|
|
===========
|
|
|
|
|
|
Quick Contact Form suffers from a persistent Cross-Site Scripting vulnerability due to a lack
|
|
of input validation and output sanitization of the qcfname4 paramater.
|
|
Other input fields are also effective to reflective cross site scripting.
|
|
|
|
|
|
PROOF OF CONCEPT
|
|
================
|
|
|
|
Enter the following into the field where Quick Contact Form requests a Message.
|
|
|
|
--- SNIP ---
|
|
|
|
"><script>alert(String.fromCharCode(90,121,48,100,48,120))</script><
|
|
|
|
--- SNIP ---
|
|
|
|
If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard.
|
|
|
|
|
|
IMPACT
|
|
======
|
|
|
|
An attacker could potentially hijack session authentication tokes of remote users and leverage the
|
|
vulnerability to increase the attack vector to the underlying software and operating system of the victim.
|
|
|
|
|
|
THREAT LEVEL
|
|
============
|
|
|
|
High
|
|
|
|
|
|
STATUS
|
|
======
|
|
|
|
Fixed update to version 6.1
|
|
|
|
|
|
DISCLAIMER
|
|
==========
|
|
|
|
nullsecurity.net hereby emphasize, that the information which is published here are
|
|
for education purposes only. nullsecurity.net does not take any responsibility for
|
|
any abuse or misusage! |