WordPress MiwoFTP Plugin Multiple Security Vulnerabilities

Bugtraq ID:	73346
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 14 2015 12:00AM
Updated:	Apr 14 2015 12:00AM
Credit:	Gjoko Krstic
Vulnerable:	WordPress MiwoFTP 1.0.5
Not Vulnerable:	WordPress MiwoFTP 1.0.6

WordPress MiwoFTP Plugin Multiple Security Vulnerabilities

The MiwoFTP plugin for WordPress is prone to multiple security vulnerabilities.

An attacker can exploit these issues to perform unauthorized actions, execute attacker-supplied HTML or JavaScript code in the context of the affected site, to steal cookie-based authentication credentials, execute arbitrary code. This may aid in further attacks.

WordPress MiwoFTP Plugin 1.0.5 is vulnerable.

WordPress MiwoFTP Plugin Multiple Security Vulnerabilities

Attackers can exploit these issues using browser or readily available tools.Attackers can exploit cross-site scripting issues by enticing an unsuspecting victim to follow a malicious URI.

WordPress MiwoFTP Plugin Multiple Security Vulnerabilities

References:

• Security Fix (miwisoft)
  
• Miwisoft Home Page (miwisoft)
  
• WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Creation Exploit (RCE) (zeroscience)
  
• WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Deletion Exploit (zeroscience)
  
• WordPress MiwoFTP Plugin 1.0.5 Multiple CSRF XSS Vulnerabilities (zeroscience)