| Title: Reflected XSS in wordpress plugin automated-registration-of-the-course v1.0 |
| Author: Larry W. Cashdollar, @_larry0 |
| Date: 2016-02-09 |
| Download Site: https://wordpress.org/plugins/automated-registration-of-the-course |
| Downloads: 2259 |
| Vendor Notified: 2016-02-09 |
| Export: Json |
| Vendor Contact: plugins@wordpress.org |
| Plugin Name: automated-registration-of-the-course |
| Vulnerability: There is a reflected XSS vulnerability in the following php code ./automated-registration-of-the-course/functions/functions.php:
153: <td class="contact"><b><?php echo $_POST['option_courses_status'] ?></b></td>
158: <td class="contact"><b><?php echo $_POST['option_courses_time_hour1'].'-'.$_POST['option_courses_time_hour2']?></b></td>
163: <td class="contact"><b><?php echo $_POST['option_courses_status'] ?></b></td>
168: <td class="contact"><b><?php echo $_POST['option_courses_status'] ?></b></td>
173: <td class="contact"><b><?php echo $_POST['option_courses_name'] ?></b></td>
178: <td class="contact"><b><?php echo $_POST['option_courses_category'] ?></b></td>
183: <td class="contact"><b><?php echo $_POST['option_courses_decscription'] ?></b></td>
188: <td class="contact"><b><?php echo $_POST['option_courses_type'] ?></b></td>
193: <td class="contact"><b><?php echo $_POST['option_courses_duration'] ?></b></td>
198: <td class="contact"><b><?php echo $_POST['option_courses_location'] ?></b></td>
203: <td class="contact"><b><?php echo $_POST['option_courses_requirements'] ?></b></td>
208: <td class="contact"><b><?php echo $_POST['option_courses_paymentinfo']?></b></td>
213: <td class="contact"><b><?php echo $_POST['option_courses_price']?></b></td>
218: <td class="contact"><b><?php echo $_POST['option_courses_content']?></b></td>
1117: <td class="contact"><b><?php echo $_POST['option_category_name'] ?></b></td>
1122: <td class="contact"><b><?php echo $_POST['option_category_type'] ?></b></td>
1127: <td class="contact"><b><?php echo $_POST['option_category_status'] ?></b></td>
The variable option_courses_status appears to send unsanitized data back to the users browser via POST request.
|
| CVE-ID: Not Released |
| File:./automated-registration-of-the-course/functions/functions.php |
| Exploit Code: Exploit was derived from appearance of first vulnerable parameter in code, there could be more shown above.
|