Advisory #: 109
Title: Persistent XSS in Media File Renamer v1.7.0
Author: Larry W. Cashdollar, @_larry0
Date: 2014-01-31
CVE-ID:[CVE-2014-2040]
CWE: CWE-79 Cross-Site Scripting (XSS)
Download Site: https://wordpress.org/plugins/media-file-renamer/
Vendor: Jordy Meow
Vendor Notified: 2014-02-04
Vendor Contact: http://www.meow.fr/#
Advisory: http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/
Description: This plugins allows you to rename physically the media files by updating their titles. It also updates theirs links in the posts automatically.
Vulnerability:
The following functions do not sanitize input before being echoed out: In file mfrh_class.settings-api.php: 166 function callback_multicheck( $args ) { 167 $value = $this->get_option( $args['id'], $args['section'], $args['std'] ); 168 169 $html = ''; 170 foreach ( $args['options'] as $key => $label ) { 171 $checked = isset( $value[$key] ) ? $value[$key] : '0'; 172 $html .= sprintf( '', $args['section'], $a rgs['id'], $key, checked( $checked, $key, false ) ); 173 $html .= sprintf( ' %3$s ', $args['section'], $args['id'], $label, $key ); 174 } 175 $html .= sprintf( ' %s', $args['desc'] ); 176 177 echo $html; 178 } function callback_radio( $args ) { 186 187 $value = $this->get_option( $args['id'], $args['section'], $args['std'] ); 188 189 $html = ''; 190 foreach ( $args['options'] as $key => $label ) { 191 $html .= sprintf( '', $args['section'], $args['id'], $ key, checked( $value, $key, false ) ); 192 $html .= sprintf( ' %3$s ', $args['section'], $args['id'], $label, $key ); 193 } 194 $html .= sprintf( ' %s', $args['desc'] ); 195 196 echo $html; 197 } function callback_wysiwyg( $args ) { 250 251 $value = wpautop( $this->get_option( $args['id'], $args['section'], $args['std'] ) ); 252 $size = isset( $args['size'] ) && !is_null( $args['size'] ) ? $args['size'] : '500px'; 253 254 echo ' '; 255 256 wp_editor( $value, $args['section'] . '[' . $args['id'] . ']', array( 'teeny' => true, 'textarea_rows' => 10 ) ); 257 258 echo ' '; 259 260 echo sprintf( ' %s', $args['desc'] ); 261 } If a user with permission to add media or edit media uploads a file with "<script>alert(1)</script>" as the title they can XSS the site admin user.
Export: JSON TEXT XML
Exploit Code:
  1.  
Screen Shots: [xss.png]
Notes:
102768