Authorized Stored XSS at WordPress Corner-Ad plugin.

vendor:

Corner-Ad

by:

Atik Rahman

7,5

CVSS

HIGH

Stored XSS

CWE

Product Name: Corner-Ad

Affected Version From: 1.0.7

Affected Version To: 1.0.7

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:corner-ad

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Firefox 44, Windows10

2017

Authorized Stored XSS at WordPress Corner-Ad plugin.

Ad name input fields aren't properly escaped. This could lead to an XSS attack that could possibly affect administrators,users,editor. To exploit, go to http://localhost/wp-admin/options-general.php?page=corner-ad.php, click on create new Add button, and use Ad name as "/><svg/onload=prompt(document.domain)>. Fill the other field and click on save corner Add button. If a normal editor,author visit the corner add list page, the XSS will effect them also.

Mitigation:

Ensure that user input is properly sanitized and escaped before being used in the application.

Source

Exploit-DB raw data:

# Exploit Title: Authorized Stored XSS at WordPress Corner-Ad plugin.
# Google Dork: inurl:/wp-content/plugins/corner-ad
# Date: 16-02-17
# Exploit Author: Atik Rahman
# Vendor Homepage: https://wordpress.org/plugins/corner-ad/
# Software Link: https://downloads.wordpress.org/plugin/corner-ad.zip
# Version: 1.0.7
# Tested on: Firefox 44, Windows10


Vendor Description
---------------------

*Corner Ad* is a plugin which display you ads in a corner of your
WordPress website page.

The Plugin has 1,000+ active install.


Stored XSS in Ad Name
----------------------

Ad name input fields aren't properly escaped. This
could lead to an XSS attack that could possibly affect
administrators,users,editor.




1. Go to http://localhost/wp-admin/options-general.php?page=corner-ad.php

2. Click on create new Add button.

3. And Use Ad name as "/><svg/onload=prompt(document.domain)> *Fill
the other field.

4.Now Click on save corner Add button when it's add a new add go to the
http://localhost/wp-admin/options-general.php?page=corner-ad.php
for corner add list. And now Your xss will

be executed.

5. If a normal editor,author visit the corner add list page xss will
effect them also.