SNS Vulnerability

Wordpress Multiple Third Party Plugins Multiple Vulnerabilities

Description

(#Multiple vulnerabilities have been identified in third-party plugins for Wordpress:#- MailPoet Newsletters: cross-site scripting via the "wysija-key" parameter of the "?wysija-page=1&controller=confirm" web page##- Booking Calendar Contact Form: SQL injection in the "admin-ajax.php?action=cpabc_appointments_calendar_update" web page##- Booking Calendar Contact Form: multiple stored cross-site scripting##- Appointment Booking Calendar: SQL injection##- IMPress Listings: cross-site scripting##- Comment Rating: cross-site scripting via the "tab" parameter of the "wpb_plugin_admin_page.php" web page##- Invoice: information disclosure, unauthorized updating of meta data and privilege escalation##- User Meta Manager: information disclosure, privilege escalation and blind SQL injection##- Huge It Image Gallery: multiple cross-site scripting via POST parameters "linkbutton" and "thumbtext" of the "wp-admin/admin-ajax.php?action=huge_it_video_gallery_ajax" web page##- Formidable Forms: blind SQL injection (CVE-2014-9309)##- Connections: cross-site scripting located in the search field (CVE-2016-0770)##- eshop: cross-site scripting (CVE-2016-0765) et blind SQL injection (CVE-2016-0769)##- Simple Add Pages Or Posts: cross-site request forgery.)

Vulnerable Products

Vulnerable Software:
WordPress (WordPress) -

Solution

- Simple add pages or posts: 1.7.

CVE

CVE-2016-0770
CVE-2016-0769
CVE-2016-0765
CVE-2014-9309

References

- NetSparker : XSS Vulnerability Identified in Mailpoet Newsletters WordPress Plugin
https://www.netsparker.com/web-applications-advisories/ns-16-002-xss-vulnerability-identified-in-mailpoet-newsletters/
- 0day : WordPress Booking Calendar Contact Form 1.1.24 - addslashes SQL Injection Vulnerability
http://0day.today/exploit/24862
- 0day : WordPress Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities
http://0day.today/exploit/24863
- 0day : Wordpress Booking Calendar Contact Form Plugin 1.1.23 - Shortcode SQL Injection Vulnerability
http://0day.today/exploit/24861
- WPVulnDB : IMPress Listings <= 2.0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
https://wpvulndb.com/vulnerabilities/8370
- 0day : WordPress Comment Rating 1.5.0 Cross Site Scripting Vulnerability
http://0day.today/exploit/24874
- Pritect : WP-Invoice < 4.1.1 Multiple Security Vulnerabilities
http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities
- BugTraq : WordPress User Meta Manager Plugin [Information Disclosure]
http://seclists.org/bugtraq/2016/Feb/48
- BugTraq : WordPress User Meta Manager Plugin [Privilege Escalation]
http://seclists.org/bugtraq/2016/Feb/34
- BugTraq : WordPress User Meta Manager Plugin [Blind SQLI]
http://seclists.org/bugtraq/2016/Feb/35
- Szurek.pl : Huge It Image Gallery 1.7.0 Reflected XSS
http://security.szurek.pl/huge-it-image-gallery-170-reflected-xss.html
- Szurek.pl : Formidable Forms 1.07.11 Blind SQL Injection
http://security.szurek.pl/formidable-forms-10711-blind-sql-injection.html
- Vapid.dhs : Wordpress plugin Reflected XSS in connections v8.5.8
http://www.vapid.dhs.org/advisory.php?v=161
- Vapid.dhs : Reflected XSS & Blind SQLi in wordpress plugin eshop v6.3.14
http://www.vapid.dhs.org/advisory.php?v=160
- PacketStormSecurity : WordPress Simple Add Pages Or Posts 1.6 Cross Site Request Forgery
https://packetstormsecurity.com/files/135508/wpsap-xsrf.txt

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious OR statement in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL	3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL	3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL	3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL	3.2.0
SQL injection Prevention - GET : possible database version probing	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL	3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
SQL injection Prevention - GET : block comment delimiters in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	5.0.0
XSS - Prevention - POST : javascript code found in data	5.0.0
XSS - Prevention - POST : suspicious tag with event found in data	5.0.0
SQL injection Prevention - POST : suspicious UPDATE statement in data	5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious SELECT statement in data	5.0.0
XSS - Prevention - POST : 'location' javascript object found in data	5.0.0
SQL injection Prevention - POST : suspicious DECLARE statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data	5.0.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL	5.0.0
XSS - Prevention - POST : code allowing cookie access found in data	5.0.0
SQL injection Prevention - POST : suspicious CAST statement in data	5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0
SQL injection Prevention - POST : suspicious EXEC statement in data	5.0.0
SQL injection Prevention - POST : suspicious CREATE statement in data	5.0.0
SQL injection Prevention - POST : suspicious INSERT statement in data	5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement	5.0.0
Serialized PHP object in HTTP header	5.0.0
XSS - Prevention - POST : 'script' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious DROP statement in data	5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	5.0.0
SQL injection Prevention - POST : suspicious HAVING statement in data	5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious UNION statement in data	5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data	5.0.0
SQL injection Prevention - POST : suspicious OR statement in data	5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data	5.0.0
SQL injection Prevention - POST : possible version probing in data	5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2016-02-05

Target Type

Client + Server

Possible exploit

Remote