WordPress XCloner Plugin Cross Site Scripting and Remote Command Execution Vulnerabilities
BID:74943
Info
WordPress XCloner Plugin Cross Site Scripting and Remote Command Execution Vulnerabilities
| Bugtraq ID: | 74943 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-4336 CVE-2015-4337 CVE-2015-4338 |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2015 12:00AM |
| Updated: | Jul 15 2015 12:24AM |
| Credit: | Larry W. Cashdollar |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress XCloner Plugin Cross Site Scripting and Remote Command Execution Vulnerabilities
The XCloner plugin for WordPress is prone to a cross-site scripting vulnerability and a remote command-execution vulnerability because it fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials or execute arbitrary commands within the context of the affected application.
XCloner 3.1.2 is vulnerable; other versions may also be affected.
The XCloner plugin for WordPress is prone to a cross-site scripting vulnerability and a remote command-execution vulnerability because it fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials or execute arbitrary commands within the context of the affected application.
XCloner 3.1.2 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress XCloner Plugin Cross Site Scripting and Remote Command Execution Vulnerabilities
An attacker can use a browser to exploit these issues. Attackers can exploit the cross-site scripting issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can use a browser to exploit these issues. Attackers can exploit the cross-site scripting issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
WordPress XCloner Plugin Cross Site Scripting and Remote Command Execution Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
WordPress XCloner Plugin Cross Site Scripting and Remote Command Execution Vulnerabilities
References:
References: