Wordpress Multiple Third Party Plugins Multiple Vulnerabilities


Description   Several vulnerabilities have been identified in plugins for WordPress:
- Responsive Thumbnail Slider: arbitrary file upload
- Responsive Thumbnail Slider: cross-site scripting in "wp-responsive-images-thumbnail-slider.php" source file
- Subscribe Comments File Read: tdirectory traversal via "options-general.php" source file
- All-in-One Migration Export: information disclosure via "wordpress_url_admin_ajax" cgi file
- Mobile Pack Information: information disclosure via "content.php" source file
- Captain Slider: cross-site scripting via slider management section
- Job Manager: information disclosure via a brute force over insecure direct object reference (CVE-2015-6668)
- SourceAFRICA: cross-site scripting via "window.php" source file
- Testimonial Slider: cross-site scripting
- Watu PRO: cross-site request forgery via "admin.php" source file
- BJ Lazy Load: arbitrary file upload
- WPML: cross-site scripting via "Accept-Language" header.
Proofs of concept are available.
Exploitation code are available for these vulnerabilities under metasploit framework.
     
Vulnerable Products   Vulnerable Software:
WordPress (WordPress) - 1.5, 1.5.1.1, 2.0, 2.0.1, 2.0.3, ..., 4.1.2, 4.2, 4.2.1, 4.2.2, 4.2.3
     
Solution   New versions of the following plugins fix the vulnerabilities impacting them:- Watu PRO: 4.9.0.8- BJ Lazy Load: 1.0- WPML: 3.2.7
     
CVE   CVE-2015-6668
     
References   - Packetstormsecurity : WordPress Responsive Thumbnail Slider 1.0 Shell Upload
https://packetstormsecurity.com/files/133360/wpresponsivets-shell.txt
Github : Land #5806
WordPress Subscribe Comments File Read Vuln
https://github.com/rapid7/metasploit-framework/commit/29e92aaabe6ee54c820812a410e03da62122733a
Github : Land #5750
Add WP All In One Migration Export Module
https://github.com/rapid7/metasploit-framework/commit/0c7d2af6bcf94454841733722db3be2fd0086e94
Github : Land #5807
Added Module WP Mobile Pack Vuln
https://github.com/rapid7/metasploit-framework/commit/3d4cb06c67e02bff822501fa345bf442fb7eedc8
Packetstormsecurity : WordPress Captain Slider 1.0.6 Cross Site Scripting
https://packetstormsecurity.com/files/133362/wpcaptainslider-xss.txt
Wpvulndb : Job Manager <= 0.7.25
Insecure Direct Object Reference
https://wpvulndb.com/vulnerabilities/8167
Packetstormsecurity : WordPress sourceAFRICA 0.1.3 Cross Site Scripting
https://packetstormsecurity.com/files/133371/wpsourceafrica-xss.txt
Packetstormsecurity : WordPress Testimonial Slider 1.2.1 Cross Site Scripting
https://packetstormsecurity.com/files/133376/wptestimonialslider-xss.txt
Wpvulndb : Watu PRO 4.8.8.4
CSRF
https://wpvulndb.com/vulnerabilities/8168
Wpvulndb : BJ Lazy Load <= 0.7.5
Remote File Inclusion (Timthumb)
https://wpvulndb.com/vulnerabilities/8174
Wpvulndb : WPML 2.9.3-3.2.6
Cross-Site Scripting (XSS) in Accept-Language Header
https://wpvulndb.com/vulnerabilities/8173
Cxsecurity : Wordpress Responsive Thumbnail Slider Stored XSS
http://cxsecurity.com/issue/WLB-2015080167
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious tag with event found in data
3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL
3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data
3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
3.2.0
XSS - Prevention - POST : 'location' javascript object found in data
3.2.0
XSS - Phishing : suspicious 'div' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL
3.2.0
XSS - Prevention - POST : javascript code found in data
3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL
3.2.0
XSS - Prevention - POST : code allowing cookie access found in data
3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data
3.2.0
XSS - Phishing : suspicious 'a' tag found in URL
3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL
3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL
3.2.0
XSS - Phishing : suspicious 'form' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data
3.2.0
XSS - Prevention - GET : javascript code found in URL
3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data
3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL
3.2.0
XSS - Phishing : suspicious 'link' tag found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
XSS - Prevention - POST : 'script' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL
3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL
3.2.0
timthumb.php wordpress plugin remote code execution
4.1.2
XSS - Prevention - POST : suspicious 'style' tag found in data
5.0.0
XSS - Prevention - POST : javascript code found in data
5.0.0
XSS - Prevention - POST : suspicious tag with event found in data
5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
5.0.0
XSS - Prevention - POST : 'location' javascript object found in data
5.0.0
XSS - Prevention - POST : code allowing cookie access found in data
5.0.0
XSS - Prevention - POST : 'script' tag found in data
5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data
5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data
5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data
5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data
5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
5.0.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2015-08-31 

 Target Type 
Client + Server 

 Possible exploit 
Remote