SNS Vulnerability

Wordpress Multiple Third Party Plugins Multiple Vulnerabilities

Description

(#Multiple vulnerabilities have been identified in third-party plugins for Wordpress:#- VideoWhisper Video Presentation: cross-site scripting in the "stream" parameter of the "wp-admin/admin-ajax.php" script when the "action" parameter is set to "vwcns_trans"##- Contest Gallery: cross-site scripting in the "GalleryID" parameter of the "./wp-fastest-cache/contest-gallery/nav-gallery.php" script##- Fastest Cache: cross-site scripting in the "error_message" parameter of the "./wp-fastest-cache/templates/update_error.php" script##- Role Scoper: cross-site scripting in the "object_name" parameter of the "/wp-admin/admin.php" script when the "page" parameter is set to value "rs-object_role_edit" (CVE-2015-8353)##- Ultimate Member: cross-site scripting in the "_refer" parameter of the "wp-admin/users.php" script, when "update" is set to value "confirm_delete" (CVE-2015-8354)##- Gwolle Guestbook: remote file inclusion in the "abspath" parameter of the "./gwolle-gb/frontend/captcha/ajaxresponse.php" script (CVE-2015-8351)##- Calls to Action: two cross-site scripting (CVE-2015-8350)##- Users Ultra: blind SQL injection##- Users Ultra: stored cross-site scripting in the "p_name" parameter of the "wp-admin/admin.php" script when the "page" parameter is set to "userultra".##Proofs of concept are available.)

Vulnerable Products

Vulnerable Software:
WordPress (WordPress) -

Solution

- Calls to Action: 2.5.1

CVE

CVE-2015-8354
CVE-2015-8353
CVE-2015-8351
CVE-2015-8350

References

- Bugtraq: Reflected XSS in Role Scoper WordPress Plugin
http://seclists.org/bugtraq/2015/Dec/6
- Bugtraq: Reflected XSS in Ultimate Member WordPress Plugin
http://seclists.org/bugtraq/2015/Dec/7
- Bugtraq: Remote File Inclusion in Gwolle Guestbook WordPress Plugin
http://seclists.org/bugtraq/2015/Dec/8
- Bugtraq: Two Reflected XSS Vulnerabilities in Calls to Action WordPress plugin
http://seclists.org/bugtraq/2015/Dec/9
- Bugtraq: WordPress Users Ultra Plugin [Blind SQL injection]
http://seclists.org/bugtraq/2015/Dec/12
- Bugtraq: WordPress Users Ultra Plugin [Persistence XSS]
http://seclists.org/bugtraq/2015/Dec/13
- 0day.today : Wordpress VideoWhisper Video Presentation plugin XSS Vulnerability
http://0day.today/exploit/24633
- 0day.today : Wordpress Contest Gallery plugin XSS Vulnerability
http://0day.today/exploit/24641
- 0day.today : Wordpress Fastest Cache plugin XSS Vulnerability
http://0day.today/exploit/24640

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	5.0.0
XSS - Prevention - POST : javascript code found in data	5.0.0
XSS - Prevention - POST : suspicious tag with event found in data	5.0.0
SQL injection Prevention - POST : suspicious UPDATE statement in data	5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious SELECT statement in data	5.0.0
Gwolle Guestbook: possible remote file inclusion using abspath	5.0.0
XSS - Prevention - POST : 'location' javascript object found in data	5.0.0
SQL injection Prevention - POST : suspicious DECLARE statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data	5.0.0
XSS - Prevention - POST : code allowing cookie access found in data	5.0.0
SQL injection Prevention - POST : suspicious CAST statement in data	5.0.0
SQL injection Prevention - POST : suspicious EXEC statement in data	5.0.0
SQL injection Prevention - POST : suspicious CREATE statement in data	5.0.0
SQL injection Prevention - POST : suspicious INSERT statement in data	5.0.0
XSS - Prevention - POST : 'script' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious DROP statement in data	5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	5.0.0
SQL injection Prevention - POST : suspicious HAVING statement in data	5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious UNION statement in data	5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious OR statement in data	5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data	5.0.0
SQL injection Prevention - POST : possible version probing in data	5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2015-12-02

Target Type

Server

Possible exploit

Remote