Wordpress Multiple Third Party Plugins Multiple Vulnerabilities


Description   Several vulnerabilities have been identified in plugins for WordPress:
- MDC Private Message: cross-site scripting located in the "message" field
- Googmonify: cross-site forgery request and cross-site scripting
- Rocket Responsive Gallery: cross-site scripting located in the "image label" field
- GeoPlaces3: arbitrary file upload located in the "upload.php" web page
- WP-Polls: cross-site scripting located in the "svg onload" parameter of the "polls-add.php" page
- Car Rental System: SQL injection located in the "pickuploc" and "dropoff" parameters
- YouTube Embed: cross-site scripting located in the "Profile name" field (CVE-2015-6535)
- Navis DocumentCloud: cross-site scripting located in the "wpbase" field of the "window.php" web page
- Private Only: cross-site scripting located in the "po_logo" field of the "privateonly.php" web page.
- Amazonify: cross-site scripting located in the "TrackingID" parameter of the "amazonify.php" web page
- NextGen Gallery: local file include.
Proofs of concept are available.
     
Vulnerable Products   Vulnerable Software:
WordPress (WordPress) - 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, ..., 4.1.2, 4.2, 4.2.1, 4.2.2, 4.2.3
     
Solution   New versions of the following plugins fix the vulnerabilities impacting them:- MDC Private Message: 1.0.1- rocket-responsive-gallery: 1.2- wp-polls: 2.70- Car Rental System: 3.1- YouTube Embed: 3.3.3- Navis DocumentCloud: 0.1.1
     
CVE   CVE-2015-6535
     
References   - 0day : WordPress MDC Private Message Plugin 1.0.0
Persistent XSS Vulnerability
http://0day.today/exploit/24107
wpvulndb : Googmonify <= 0.5.1
CSRF & XSS
https://wpvulndb.com/vulnerabilities/8158
BHunter : WordPress Rocket Responsive Gallery Plugin Stored XSS
http://bhunter.ir/2015/08/wordpress-rocket-responsive-gallery-plugin-stored-xss/
Exploit database : WordPress GeoPlaces3 Theme
Arbitrary File Upload Vulnerbility
https://www.exploit-db.com/exploits/37956/
wpvulndb : WP-Polls <= 2.70
Stored Cross-Site Scripting (XSS)
https://wpvulndb.com/vulnerabilities/8160
packetstorm : WordPress Car Rental System SQL Injection
https://packetstormsecurity.com/files/133326/wpcarrental-sql.txt
SecList : CVE-2015-6535: Stored XSS in YouTube Embed (WordPress plugin) allows admins to compromise super admins
http://seclists.org/bugtraq/2015/Aug/146
dxw : Publicly exploitable XSS in WordPress plugin Navis Documentcloud
https://security.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/
dxw : CSRF/XSS vulnerability in Private Only could allow an attacker to do almost anything an admin user can
https://security.dxw.com/advisories/csrfxss-vulnerability-in-private-only-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/
0day : Wordpress Amazonify Plug-in XSS/CSRF Vulnerabilities
http://0day.today/exploit/24108
oss-sec : CVE Request
LFI/Path Traversal in NextGen Gallery WordPress Plugin.
http://seclists.org/oss-sec/2015/q3/453
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious tag with event found in data
3.2.0
Misc : Directory traversal - parameter starting with ../
3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL
3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data
3.2.0
SQL injection Prevention - POST : suspicious SELECT statement in data
3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data
3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL
3.2.0
SQL injection Prevention - POST : possible version probing in data
3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
3.2.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data
3.2.0
SQL injection Prevention - POST : suspicious CREATE statement in data
3.2.0
XSS - Prevention - POST : 'location' javascript object found in data
3.2.0
Directory traversal using ..\..
3.2.0
SQL injection Prevention - POST : suspicious UPDATE statement in data
3.2.0
XSS - Phishing : suspicious 'div' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL
3.2.0
XSS - Prevention - POST : javascript code found in data
3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL
3.2.0
SQL injection Prevention - POST : suspicious UNION statement in data
3.2.0
XSS - Prevention - POST : code allowing cookie access found in data
3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data
3.2.0
Directory traversal
3.2.0
SQL injection Prevention - POST : suspicious DROP statement in data
3.2.0
SQL injection Prevention - POST : suspicious INSERT statement in data
3.2.0
SQL injection Prevention - POST : suspicious OR statement in data
3.2.0
XSS - Phishing : suspicious 'a' tag found in URL
3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL
3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL
3.2.0
SQL injection Prevention - POST : suspicious EXEC statement in data
3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL
3.2.0
XSS - Phishing : suspicious 'form' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data
3.2.0
XSS - Prevention - GET : javascript code found in URL
3.2.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data
3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data
3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL
3.2.0
Directory traversal backward root folder
3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL
3.2.0
SQL injection Prevention - POST : suspicious DECLARE statement in data
3.2.0
XSS - Phishing : suspicious 'link' tag found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
XSS - Prevention - POST : 'script' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL
3.2.0
SQL injection Prevention - POST : suspicious HAVING statement in data
3.2.0
SQL injection Prevention - POST : suspicious CAST statement in data
3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data
5.0.0
XSS - Prevention - POST : javascript code found in data
5.0.0
XSS - Prevention - POST : suspicious tag with event found in data
5.0.0
SQL injection Prevention - POST : suspicious UPDATE statement in data
5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
5.0.0
SQL injection Prevention - POST : suspicious SELECT statement in data
5.0.0
XSS - Prevention - POST : 'location' javascript object found in data
5.0.0
SQL injection Prevention - POST : suspicious DECLARE statement in data
5.0.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data
5.0.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data
5.0.0
XSS - Prevention - POST : code allowing cookie access found in data
5.0.0
SQL injection Prevention - POST : suspicious CAST statement in data
5.0.0
SQL injection Prevention - POST : suspicious EXEC statement in data
5.0.0
SQL injection Prevention - POST : suspicious CREATE statement in data
5.0.0
SQL injection Prevention - POST : suspicious INSERT statement in data
5.0.0
XSS - Prevention - POST : 'script' tag found in data
5.0.0
SQL injection Prevention - POST : suspicious DROP statement in data
5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
5.0.0
SQL injection Prevention - POST : suspicious HAVING statement in data
5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
5.0.0
SQL injection Prevention - POST : suspicious UNION statement in data
5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data
5.0.0
SQL injection Prevention - POST : suspicious OR statement in data
5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data
5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data
5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data
5.0.0
SQL injection Prevention - POST : possible version probing in data
5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
5.0.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2015-08-21 

 Target Type 
Client + Server 

 Possible exploit 
Remote