SNS Vulnerability

WordPress Third-Party Plugins Multiple Vulnerabilities

Description

(#Several vulnerabilities have been identified in third-party plugins for WordPress:#- cmw-speakers: SQL injection in the "id" parameter of the "speaker_details.php" page#- 404 Redirection Manager: SQL injection#- Stop User Enumeration: cross-site scripting#- Direct Download for WooCommerce: local file inclusion allowing remote download from the server#- WangGuard: cross-site scripting.##Proofs of concept are available.)

Vulnerable Products

Vulnerable Software:
WordPress (WordPress) -

Solution

Version 1.3.8 of plugin Stop User Enumeration fixes the vulnerability affecting it.

CVE

References

- pluginvulnerabilities : Reflected Cross-Site Scripting (XSS) Vulnerability in WangGuard | Plugin Vulnerabilities
https://www.pluginvulnerabilities.com/2017/01/17/reflected-cross-site-scripting-xss-vulnerability-in-wangguard/
- Full Disclosure : New exploit for new vulnerability in WordPress Plugin + tutorial
http://seclists.org/fulldisclosure/2017/Jan/39
- cxsecurity : Wordpress cmw-speakers Plugin SQL injection Vulnerability - CXSecurity.com
https://cxsecurity.com/issue/WLB-2017010090
- wpvulndb : 404 Redirection Manager 1.0 - SQL Injection
https://wpvulndb.com/vulnerabilities/8722
- wpvulndb : Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)
https://wpvulndb.com/vulnerabilities/8723

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious OR statement in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL	3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL	3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL	3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL	3.2.0
SQL injection Prevention - GET : possible database version probing	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL	3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
SQL injection Prevention - GET : block comment delimiters in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL	5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement	5.0.0
SQL injection Prevention - GET : suspicious SQL keywords in URL	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2017-01-15

Target Type

Server

Possible exploit

Remote