WordPress Count per Day Plugin Arbitrary File Download and Cross Site Scripting Vulnerabilities

Bugtraq ID:	51402
Class:	Unknown
CVE:	CVE-2012-0895 CVE-2012-0896
Remote:	Yes
Local:	No
Published:	Jan 12 2012 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	6Scan
Vulnerable:	WordPress Count per Day 2.17
Not Vulnerable:	WordPress Count per Day 3.1.1

WordPress Count per Day Plugin Arbitrary File Download and Cross Site Scripting Vulnerabilities

WordPress Count per Day plugin is prone to an arbitrary file download and a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data.

Attackers may leverage these issues to download arbitrary files in the context of the webserver process and execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

WordPress Count per Day versions prior to 3.1.1 are vulnerable.

WordPress Count per Day Plugin Arbitrary File Download and Cross Site Scripting Vulnerabilities

An attacker can exploit the file download issue with a browser. To exploit a cross-site scripting issue the attacker must entice an unsuspecting victim to follow a malicious URI.

The following example URIs are available:

Arbitrary file download:
http://www.example.com/wp-content/plugins/count-per-day/download.php?n=1&f=/etc/passwd

Cross-site scripting:

• /data/vulnerabilities/exploits/51402.txt

WordPress Count per Day Plugin Arbitrary File Download and Cross Site Scripting Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.

WordPress Count per Day Plugin Arbitrary File Download and Cross Site Scripting Vulnerabilities

References:

• WordPress Count per Day Plugin Homepage (WordPress)