Wordpress GigPress XSS

2015.09.15
Credit: mir.ght
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: Wordpress GigPress XSS # Date: 2015-09-15 # Exploit Author: Amir.ght # Vendor Homepage: https://wordpress.org/plugins/gigpress/ # Software Link: https://downloads.wordpress.org/plugin/gigpress.zip # Version: 2.3.12 # Tested on: windows 7 / FireFox #################################################### # Exploit : For Exploiting This Vulnerability You Should Install GigPress Plugin Goto Settings Of GigPress ,Now You Can Input Your JavaScript Code In Every input For Execution Codes click on "Save Changes" button #################################################################### # Vulnerable File : /wp-content/plugins/gigpress/admin/settings.php # Vulnerable codes: Lines : 24,29,35,54,61,68,77,83,89,95,101,116,148,168,174 [24] : <input type="text" size="48" name="gigpress_settings[shows_page]" value="<?php echo $gpo['shows_page']; ?>" /> [29] : <input type="text" name="gigpress_settings[noupcoming]" size="48" value="<?php echo $gpo['noupcoming']; ?>" /> [35] : <input type="text" name="gigpress_settings[nopast]" size="48" value="<?php echo $gpo['nopast']; ?>" /> [54] : <input type="text" name="gigpress_settings[date_format]" value="<?php echo $gpo['date_format']; ?>" /> [61] : <input type="text" name="gigpress_settings[date_format_long]" value="<?php echo $gpo['date_format_long']; ?>" /> [68] : <input type="text" name="gigpress_settings[time_format]" value="<?php echo $gpo['time_format']; ?>" /> [77] : <input type="text" name="gigpress_settings[artist_label]" size="48" value="<?php echo $gpo['artist_label']; ?>" /> [83] : <input type="text" name="gigpress_settings[tour_label]" size="48" value="<?php echo $gpo['tour_label']; ?>" /> [89] : <input type="text" name="gigpress_settings[external_link_label]" size="48" value="<?php echo $gpo['external_link_label']; ?>" /> [95] : <input type="text" name="gigpress_settings[buy_tickets_label]" size="48" value="<?php echo $gpo['buy_tickets_label']; ?>" /> [101] : <input type="text" name="gigpress_settings[age_restrictions]" size="48" value="<?php echo $gpo['age_restrictions']; ?>" /> [116] : <input type="text" name="gigpress_settings[related_heading]" size="48" value="<?php echo $gpo['related_heading']; ?>" /> [148] : <input type="text" name="gigpress_settings[related]" size="48" value="<?php echo $gpo['related']; ?>" /> [168] : <input type="text" name="gigpress_settings[rss_title]" size="48" value="<?php echo $gpo['rss_title']; ?>" /> [174] : <input type="text" name="gigpress_settings[rss_limit]" size="48" value="<?php echo $gpo['rss_limit']; ?>" /> ########################################################## # For Patch : Should Use htmlspecialchars() For Example Replace Line 24 With : <input type="text" size="48" name="gigpress_settings[shows_page]" value="<?php echo htmlspecialchars($gpo['shows_page']); ?>" />


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top