Home / os / winmobile

Soundy Background Music 3.1 Cross Site Scripting

Posted on 16 March 2016

## FULL DISCLOSURE

#Product : Soundy Background Music
#Exploit Author : Rahul Pratap Singh
#Version : 3.1
#Home page Link : https://wordpress.org/plugins/soundy-background-music/
#Website : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94
#Date : 12/3/2016

XSS Vulnerability:

----------------------------------------
Description:
----------------------------------------
"war_soundy_audio_volume" parameter is not sanitized that leads to
Reflected XSS.

----------------------------------------
Vulnerable Code:
----------------------------------------

soundy.php

1462-1473

if( $audio_volume_def == 'default' )
{
$audio_volume = 'default';
}
else
{
$audio_volume = $_POST[ 'war_soundy_audio_volume' ];
}

update_post_meta( $post_id,
'war_soundy_audio_volume',
$audio_volume );

----------------------------------------
POC:
----------------------------------------
https://0x62626262.files.wordpress.com/2016/03/soundy_background_music_xss.png

Fix:
Update to 3.2

Vulnerability Disclosure Timeline:
→ March 3, 2016 – Bug discovered, initial report to WordPress
→ March 7, 2016 – No response, Report sent again.
→ March 8, 2016 – WordPress response, plugin taken down
→ March 10, 2016 – Vendor deployed a patch

#######################################
#CTG SECURITY SOLUTIONS #
#www.ctgsecuritysolutions.com #
#######################################

Pub Ref:
https://wordpress.org/plugins/soundy-background-music/changelog/

 

TOP

Malware :

Exploits :