SNS Vulnerability

WordPress Third-Party Modules Multiple Vulnerabilities

Description

(#Several vulnerabilities have been identified in third-party plugins for WordPress:#- Olimometer: SQL injection in the "olimometer_id" parameter of the "plugins/olimometer/thermometer.php" page##- Wp-D3: cross-site request forgery##- FancyBox: full path disclosure in the "plugins/fancybox-for-wordpress/lib/admin-head.php" page##- Image Gallery: stored cross-site scripting in the source URL via the "sl_url11" POST parameter.##Proof of concepts are available.)

Vulnerable Products

Vulnerable Software:
WordPress (WordPress) -

Solution

- Image Gallery: 2.0.6.

CVE

References

- Howucan : Wordpress Plugin Olimometer 2.56 - SQL Injection vulnerability
https://howucan.gr/vulnerabilities/wordpress-exploits/1288-wordpress-plugin-olimometer-2-56-sql-injection-vulnerability
- Twitter : Wp-D3 CSRF fixed today
https://twitter.com/klikkioy/status/800750988437188608
- CXSecurity : Wordpress FancyBox For Wordpress Plugin Full Path Disclosure
https://cxsecurity.com/issue/WLB-2016110192
- SumofPwn : Stored Cross-Site Scripting in Gallery - Image Gallery WordPress Plugin
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_in_gallery___image_gallery_wordpress_plugin.html

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
SQL injection Prevention - GET : suspicious OR statement in URL	3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL	3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL	3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL	3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL	3.2.0
SQL injection Prevention - GET : possible database version probing	3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL	3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL	3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL	3.2.0
SQL injection Prevention - GET : block comment delimiters in URL	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	5.0.0
XSS - Prevention - POST : javascript code found in data	5.0.0
XSS - Prevention - POST : suspicious tag with event found in data	5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	5.0.0
XSS - Prevention - POST : 'location' javascript object found in data	5.0.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL	5.0.0
XSS - Prevention - POST : code allowing cookie access found in data	5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0
CMS plugin - Full Path Disclosure Vulnerability	5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement	5.0.0
XSS - Prevention - POST : 'script' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data	5.0.0
SQL injection Prevention - GET : suspicious SQL keywords in URL	5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2016-11-22

Target Type

Server

Possible exploit

Remote