##################################################### # Exploit Title : Wordpress WP Fade in Text News Plugin Cross Site Scripting # Author : Ehsan Noreddini # Plugin Page : https://wordpress.org/plugins/wp-fade-in-text-news/ # Date: 2015-08-19 # Tested On : Firefox / Chormodo # Software Link : https://downloads.wordpress.org/plugin/wp-fade-in-text-news.zip # Version : 10.6 ##################################################### # Exploit Steps: # # 1. Go to news in [HOME]/wp-admin/options-general.php?page=wp-fade-in-text-news&ac=add page . # # 2. Put the Simple XSS payload to in `Enter the news/message` field. For Example : <script>alert("Test")</script> # # 3. Now see the result : [HOME]/wp-admin/options-general.php?page=wp-fade-in-text-news # # Screenshot: http://ehsann.info/proof/WP_Fade_in_Text_News.png # ##################################################### # Patch: # # 1. Go to [HOME]\wp-content\plugins\wp-fade-in-text-news\pages\ address and edit content-management-show.php # file . # # 2. Change this line : # # 99: <td><?php echo stripslashes($data['FadeIn_text']); ?> # to : # <td><?php echo htmlspecialchars($data['FadeIn_text']); ?> # #####################################################