SNS Vulnerability

Wordpress Multiple Third Party Plugins Multiple Vulnerabilities

Description

(#Several vulnerabilities have been identified in third party plugins for WordPress:#- Blubrry PowerPress Podcasting: cross-site scripting via the POST parameter "tab" of the page "wp-admin/admin.php?page=powerpress/powerpressadmin_basic.php"##- Fast Secure Contact Form: cross-site scripting via the POST parameter "fs_contact_form1[welcome]" of the page "wp-admin/plugins.php?page=si-contact-form%2Fsi-contact-form.php"##- BulletProof Security: cross-site scripting via the POST parameter "DBTablePrefix" of the page "wp-admin/admin.php?page=bulletproof-security/admin/db-backup-security/db-backup-security.php"##- NextGEN Gallery by Photocrati: several cross-site scripting##- NextGEN Gallery by Photocrati: remote file upload due to improper poor filtering of file extensions. This vulnerability is exploitable via the POST parameter "name" of the page "wp-admin/post-new.php?post_type=wpsc-product"##- WP-DB-Backup: information disclosure allowing to download Wordpress database. This vulnerability is only exploitable if you choose "local" as a backup repository (not by default)##- Crony Cronjob Manager: cross-site scripting and cross-site request forgery the POST parameter "name"##- Form Manager: arbitrary code execution (CVE-2015-7806)##- wp-championship : blind SQL Injection. This vulnerability is located in the "isadmin" parameter of the "wp-admin/wp-championship/cs_admin_users.php" web page. To exploit it, the attacker must be authenticated.##Exploitation codes are available for the vulnerabilities affecting plugins WP-DB-Backup and Form Manager.##Proofs of concept are available.)

Vulnerable Products

Vulnerable Software:
WordPress (WordPress) -

Solution

Version 5.9 of the wp-championship plugin fixes the CVE-2015-5308 vulnerability.

CVE

CVE-2015-7806
CVE-2015-5308

References

- CyberSecurityWorks : XSS Vulnerability in Blubrry PowerPress Podcasting plugin Version 6.0.4 #7
https://github.com/cybersecurityworks/Disclosed/issues/7
- CyberSecurityWorks : XSS Vulnerability in Fast Secure Contact form version 4.0.37 #4
https://github.com/cybersecurityworks/Disclosed/issues/4
- CyberSecurityWorks : XSS Vulnerability in BulletProof Security Version .52.4 #3
https://github.com/cybersecurityworks/Disclosed/issues/3
- CyberSecurityWorks : Multiple XSS in NextGEN Gallery by Photocrati Version 2.1.7 #1
https://github.com/cybersecurityworks/Disclosed/issues/1
- CyberSecurityWorks : Malicious File Upload in NextGEN Gallery by Photocrati Version 2.1.10 #6
https://github.com/cybersecurityworks/Disclosed/issues/6
- Vapid.DHS : Wordpress WP-DB-Backup v2.2.4 Plugin Remote Database Backup Download Vulnerability
http://www.vapid.dhs.org/advisory.php?v=81
- CyberSecurityWorks : Cross Site Scripting (XSS) & Cross Site Request Forgery (CSRF) in Crony Cronjob Manager Version 0.4.4 #9
https://github.com/cybersecurityworks/Disclosed/issues/9
- appcheck-ng : Remote Command Execution in WordPress Form Manager Plugin (CVE-2015-7806)
http://appcheck-ng.com/remote-command-execution-in-wordpress-form-manager-plugin-cve-2015-7806/
- vapid : Blind SQL injection in wp-championship wordpress plugin v5.8
http://www.vapid.dhs.org/advisory.php?v=155
- Seclists : Blind SQL injection in wp-championship wordpress plugin v5.8
http://seclists.org/oss-sec/2015/q4/244

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	5.0.0
Wordpress remote code execution in Form Manager Plugin	5.0.0
XSS - Prevention - POST : javascript code found in data	5.0.0
XSS - Prevention - POST : suspicious tag with event found in data	5.0.0
SQL injection Prevention - POST : suspicious UPDATE statement in data	5.0.0
Attempt to access to SQL backup folder	5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious SELECT statement in data	5.0.0
XSS - Prevention - POST : 'location' javascript object found in data	5.0.0
Upload of a PHP file in a vulnerable web application	5.0.0
SQL injection Prevention - POST : suspicious DECLARE statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data	5.0.0
XSS - Prevention - POST : code allowing cookie access found in data	5.0.0
SQL injection Prevention - POST : suspicious CAST statement in data	5.0.0
SQL injection Prevention - POST : suspicious EXEC statement in data	5.0.0
SQL injection Prevention - POST : suspicious CREATE statement in data	5.0.0
SQL injection Prevention - POST : suspicious INSERT statement in data	5.0.0
XSS - Prevention - POST : 'script' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious DROP statement in data	5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	5.0.0
SQL injection Prevention - POST : suspicious HAVING statement in data	5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious UNION statement in data	5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious OR statement in data	5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data	5.0.0
SQL injection Prevention - POST : possible version probing in data	5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2015-11-02

Target Type

Server

Possible exploit

Remote