Organizer plugin for WordPress Security Vulnerabilities

vendor:

Organizer

by:

SecurityFocus

7,5

CVSS

HIGH

Cross-site scripting, Information-disclosure, Directory-traversal

79, 200, 22

CWE

Product Name: Organizer

Affected Version From: 1.2.1

Affected Version To: 1.2.1

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:organizer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Organizer plugin for WordPress Security Vulnerabilities

Organizer plugin for WordPress is prone to multiple security vulnerabilities, including cross-site scripting, information-disclosure, and directory-traversal. Attackers may leverage these issues to steal cookie-based authentication credentials, execute arbitrary script code in the browser, or disclose sensitive information; other attacks are also possible. Organizer 1.2.1 is vulnerable; other versions may also be affected.

Mitigation:

Users should upgrade to the latest version of the Organizer plugin for WordPress.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/54039/info

The Organizer plugin for WordPress is prone to the following security vulnerabilities:

1. A cross-site scripting vulnerability.
2. An information-disclosure vulnerability.
3. A directory-traversal vulnerability.

Attackers may leverage these issues to steal cookie-based authentication credentials, execute arbitrary script code in the browser, or disclose sensitive information; other attacks are also possible.

Organizer 1.2.1 is vulnerable; other versions may also be affected. 

Directory-traversal vulnerability:

http://www.example.com/wp-admin/wp-admin/admin.php?page=organizer/page/view.php

Cross-site scripting vulnerability:

http://www.example.com/wp-admin/admin.php?page=organizer/page/dir.php
"><script>alert(document.cookie)</script>

Information-disclosure vulnerability:

http://www.example.com/wp-admin/admin.php?page=organizer/page/users.php