WordPress Plugin UserPro 4.9.32 Cross-Site Scripting

2019.09.08
Credit: Damian Ebelties
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2019-14470
CWE: CWE-79
Dork: intitle:"Index of" intitle:"UserPro" -uploads


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

# Exploit Title: UserPro <= 4.9.32 Reflected XSS # Google Dork: intitle:"Index of" intitle:"UserPro" -uploads # Date: 25 August 2019 # Exploit Author: Damian Ebelties (https://zerodays.lol/) # Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 # Version: <= 4.9.32 # Tested on: Ubuntu 18.04.1 # CVE: CVE-2019-14470 The WordPress plug-in 'UserPro' uses a Instagram library (Instagram PHP API V2 by cosenary) that is vulnerable for Reflected Cross-Site Scripting (XSS). There is more vulnerable code in 'UserPro' core, might release that later. As of today (25 August 2019) this issue is unfixed. Vulnerable code: (success.php on line 36) if (isset($_GET['error'])) { echo 'An error occurred: ' . $_GET['error_description']; } > https://github.com/cosenary/Instagram-PHP-API/blob/master/example/success.php#L36 Proof-of-Concept: https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top