HMS Testimonials CVE-2013-4241 Multiple Cross Site Scripting Vulnerabilities
BID:61850
Info
HMS Testimonials CVE-2013-4241 Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 61850 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-4241 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 08 2013 12:00AM |
| Updated: | Aug 08 2013 12:00AM |
| Credit: | Adéla Goldová |
| Vulnerable: |
Jeff Kreitner Hms-Testimonials 2.0.10 Jeff Kreitner Hms-Testimonials 2.0.9 |
| Not Vulnerable: |
Jeff Kreitner Hms-Testimonials 2.0.11 |
Discussion
HMS Testimonials CVE-2013-4241 Multiple Cross Site Scripting Vulnerabilities
The HMS Testimonials plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
HMS Testimonials 2.0.10 is vulnerable; other versions may also be affected.
NOTE: These issues was previously covered in BID 61712 (HMS Testimonials Multiple Cross Site Scripting and Cross Site Request Forgery Vulnerabilities), but has been assigned its own record to better document it.
The HMS Testimonials plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
HMS Testimonials 2.0.10 is vulnerable; other versions may also be affected.
NOTE: These issues was previously covered in BID 61712 (HMS Testimonials Multiple Cross Site Scripting and Cross Site Request Forgery Vulnerabilities), but has been assigned its own record to better document it.
Exploit / POC
HMS Testimonials CVE-2013-4241 Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following exploit is available:
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following exploit is available: