Wordpress Zingiri Web Shop Plugin

vendor:

Zingiri Web Shop

by:

Mehmet Ince

7,5

CVSS

HIGH

Multiple XSS

79, 89

CWE

Product Name: Zingiri Web Shop

Affected Version From: 2.3.0

Affected Version To: 2.4.0

Patch Exists: NO

Related CWE: N/A

CPE: a:zingiri:zingiri_web_shop

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 11.10 Server

2012

WordPress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities

Wordpress Zingiri Web Shop Plugin contains multiple XSS vulnerabilities. The 'page' variable in plugins/zingiri-web-shop/zing.inc.php is not properly sanitized before being used, allowing an attacker to inject malicious JavaScript code. Additionally, the 'notes' variable in fws/pages-front/onecheckout.php is also not properly sanitized before being used, allowing an attacker to inject malicious JavaScript code. This code can be stored in the database and executed when an administrator views the list of ordered items.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to generate dynamic content. Additionally, output encoding should be used to ensure that user-supplied data is not interpreted as HTML or JavaScript.

Source

Exploit-DB raw data:

##############################################################################
Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities

author...............: Mehmet Ince
twitte...............: https://twitter.com/#!/mmetince
mail.................: mehmet.ince@bga.com.tr
software link........: http://www.zingiri.com
affected versions....: tested on 2.3.0 and 2.4.0
# Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS
Vulnerabilities
# Google Dork:
# Date: 26 Apr 2012
# Author: Mehmet INCE
# Software Link:
http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.0.zip
# Version: 2.4.0 and older.
# Tested on: version of 2.3.0 and 2.4.0 with Ubuntu 11.10 Server with
Firefox browser.
##############################################################################
/*
## BASIC XSS
PS: Exploitable without Authentication

plugins/zingiri-web-shop/zing.inc.php

line at 401.

if ($process=='content' && $page!='ajax' && $page!='downldr') echo '<div
class="zing_ws_page" id="zing_ws_'.$_GET['page'].'">';

Exploit:
http://localhost/wordpress/?page=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

'page' variable isn't properly sanitized before being used.


## STORED XSS
PS: Attacker should be logged for exploit.
./fws/pages-front/onecheckout.php

line 27-29
if (!empty($_POST['notes'])) {
$notes=$_POST['notes'];
}

and line 348
<textarea name="notes" rows="5" style="width: 100%"><?php echo
$notes;?>&lt;/textarea&gt;<br />

'notes' variable isn't properly sanitized before being used.

That's very basic XSS vulnerabilities. But you dont need use fishing attack
to target webpage's administrator. That application insert datas to
database with that form. After your malicious code posted up, your
javascrip code inserted to database with $_POST['notes'] variable. When
administrator wanna see list of ordered items list. Javascript codes will
come from database and start working on Authenticated admin user side.
After that You can use browser keylogger with BT5 tools or can usee cookie
grabber.
*/

step 1: Login to wordpress.

step 2: Go to "Shop" menu. It's should be stay at banner.

http://6.6.6.102/wordpress/?page_id=14

step 3: Than you'll see list ot items. Click one of them.

http://6.6.6.102/wordpress/?page=details&prod=2&cat=1&page_id=14

step 4: You can pass that form action. That wont be problem..! Click to
"Order" button.

step 5: There is confirmation about the Shopping. Click "checkout" to pass
that page.

step 6: It's final stage. Put you javascript payload to "Additional
comments/questions" form. After you click checkout button, that form will
get all of these input data with POST method.

step 7: Click to "Checkout"