WordPress CM Ad Changer 1.7.2 Cross Site Scripting
Posted on 26 April 2016
## FULL DISCLOSURE #Product : cm-ad-changer #Exploit Author : Rahul Pratap Singh #Version :1.7.2 #Home page Link : https://wordpress.org/plugins/cm-ad-changer/ #Website : 0x62626262.wordpress.com #Linkedin : https://in.linkedin.com/in/rahulpratapsingh94 #Date : 21/4/2016 XSS Vulnerability: ---------------------------------------- Description: ---------------------------------------- Following parameters are not sanitized that leads to XSS Vulnerability. title, comment, link ---------------------------------------- Vulnerable Code: ---------------------------------------- File Name: testfiles/cm-ad-changer/backend/views/admin_settings.php Found at line:61 <input type="checkbox" name="acs_active" id="acs_active" value="1" <?php echo ($fields_data['acs_active'] == '1' ? 'checked=checked' : '') ?> /> Found at line:73 <textarea id="acs_custom_css" name="acs_custom_css" rows=7 value="<?php echo stripslashes($fields_data['acs_custom_css']) ?>"><?php echo stripslashes($fields_data['acs_custom_css']) ?></textarea> File Name: testfiles/cm-ad-changer/backend/views/admin_campaigns.php Found at line:96 <textarea value="<?php echo (isset($fields_data['comment']) ? stripslashes($fields_data['comment']) : '') ?>" name="comment" id="comment"><?php echo (isset($fields_data['comment']) ? stripslashes($fields_data['comment']) : '') ?></textarea> ---------------------------------------- POC: ---------------------------------------- https://0x62626262.files.wordpress.com/2016/04/cm-ad-changer-xss-poc.png https://0x62626262.files.wordpress.com/2016/04/cm-ad-changer-xss-poc1.png Fix: Update to 1.7.6 Vulnerability Disclosure Timeline: → March 14, 2016 – Bug discovered, initial report to Vendor. → March 22, 2016 – No Response. Report sent again. → March 23, 2016 – WordPress Acknowledged. → April 21, 2016 – Full Disclosure. Pub Ref: https://0x62626262.wordpress.com/2016/04/21/cm-ad-changer-xss-vulnerability/ https://ad-changer.cminds.com/cm-ad-changer-plugin-free-edition-release-notes/
