============================================================
Link Farm Evolution 1.8.7 Cross Site Scripting Vulnerability
============================================================
Description: Link Farm evolution is a wordpress premium plugin used to
build backlinks.
Version : 1.0
Severity : Low to Moderate
Authors : Prakhar Prasad http://www.prakharprasad.com
Rafay Baloch http://www.rafayhackingarticles.net
Vendor : LinkFarmEvolution - http://linkfarmevolution.com/
Details:
The vulnerability exists inside the zeroclipboard.swf. Multiplle calls are
made to Externalinterface.call, The id parameter is an input parameter
which is passed to
the Externalinterface.call function wtihout being properly sanitised, hence
allowing us to execute javascript.
Vulnerable Code:
button.addEventListener(MouseEvent.MOUSE_OVER, function(event:Event) {
ExternalInterface.call( 'ZeroClipboard.dispatch', id, 'mouseOver', null );
} );
button.addEventListener(MouseEvent.MOUSE_OUT, function(event:Event) {
ExternalInterface.call( 'ZeroClipboard.dispatch', id, 'mouseOut', null );
} );
button.addEventListener(MouseEvent.MOUSE_DOWN, function(event:Event) {
ExternalInterface.call( 'ZeroClipboard.dispatch', id, 'mouseDown', null );
} );
button.addEventListener(MouseEvent.MOUSE_UP, function(event:Event) {
ExternalInterface.call( 'ZeroClipboard.dispatch', id, 'mouseUp', null );
} );
Proof-of-Concept:
Multiplle calls are made to Externalinterface.call, The id parameter is an
input parameter which is passed to
the Externalinterface.call function wtihout being properly sanitised, hence
allowing us to execute javascript.
POC:
localhost/Link Farm Evolution 1.85/js/ZeroClipboard.swf#id=
Solution:
Any input passed through externalinterface.call function should be
escaped/sanitised.
