WordPress Foxypress Plugin Multiple Security Vulnerabilities
BID:56332
Info
WordPress Foxypress Plugin Multiple Security Vulnerabilities
| Bugtraq ID: | 56332 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 30 2012 12:00AM |
| Updated: | Oct 30 2012 12:00AM |
| Credit: | Janek Vind |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress Foxypress Plugin Multiple Security Vulnerabilities
The Foxypress plug-in for WordPress is prone to multiple security vulnerabilities, including:
1. An arbitrary file-upload vulnerability.
2. Multiple SQL-injection vulnerabilities.
3. Multiple HTML-injection vulnerabilities.
4. A URI-redirection vulnerability.
5. Multiple information-disclosure vulnerabilities.
6. Multiple cross-site request-forgery vulnerabilities.
7. Multiple security-bypass vulnerabilities.
Attackers can exploit these issues to bypass certain security restrictions, redirect users to an attacker-controlled site, obtain sensitive information, perform certain administrative actions, gain unauthorized access, upload arbitrary files, compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks may also be possible.
The Foxypress plug-in for WordPress is prone to multiple security vulnerabilities, including:
1. An arbitrary file-upload vulnerability.
2. Multiple SQL-injection vulnerabilities.
3. Multiple HTML-injection vulnerabilities.
4. A URI-redirection vulnerability.
5. Multiple information-disclosure vulnerabilities.
6. Multiple cross-site request-forgery vulnerabilities.
7. Multiple security-bypass vulnerabilities.
Attackers can exploit these issues to bypass certain security restrictions, redirect users to an attacker-controlled site, obtain sensitive information, perform certain administrative actions, gain unauthorized access, upload arbitrary files, compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks may also be possible.
Exploit / POC
WordPress Foxypress Plugin Multiple Security Vulnerabilities
Attackers can the exploit arbitrary file-upload, HTML-injection and SQL-injection issues through a browser. Attackers can exploit the cross-site request-forgery issue by enticing a user into visiting a malicious site. Attackers can exploit the URI-redirection issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs and input data are available:
Attackers can the exploit arbitrary file-upload, HTML-injection and SQL-injection issues through a browser. Attackers can exploit the cross-site request-forgery issue by enticing a user into visiting a malicious site. Attackers can exploit the URI-redirection issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs and input data are available:
Solution / Fix
WordPress Foxypress Plugin Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
WordPress Foxypress Plugin Multiple Security Vulnerabilities
References:
References:
- [waraxe-2012-SA#095] - Multiple Vulnerabilities in Wordpress FoxyPress Plugin (Waraxe IT Security Portal)
- FoxyPress Homepage (WordPress)