[FD] CSRF and stored XSS in WordPress Content Slide allow an attacker to have full admin privileges (WordPress plugin)

[dxw Security <security@xxxxxxx>]

Details
================
Software: Wordpress Content Slide
Version: 1.4.2
Homepage: http://wordpress.org/plugins/content-slide/
Advisory report: 
https://security.dxw.com/advisories/csrf-and-stored-xss-in-wordpress-content-slide-allow-an-attacker-to-have-full-admin-privileges/
CVE: Awaiting assignment
CVSS: 6.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:P)

Description
================
CSRF and stored XSS in WordPress Content Slide allow an attacker to have full 
admin privileges

Vulnerability
================
An attacker able to convince an admin to visit a link of their choosing is able 
to execute arbitrary javascript:
A CSRF vulnerability allows an attacker to change any option in the plugin. The 
plugin does not escape content when put into HTML so the attacker can then use 
JavaScript to perform almost any action an admin can take (including creating 
new users, executing arbitrary php through the theme editor or exploiting 
vulnerabilities in WordPress or other plugins which normally require the user 
to be authenticated as an admin).

Proof of concept
================
While logged into a site with the plugin enabled open a page containing the 
following form and click the submit button (in a real attack the form could be 
made to auto-submit):
<form 
action=\"http://localhost/wp-admin/admin.php?page=content-slide/content_slide.php\";
 method=\"POST\">
  <input type=\"text\" name=\"wpcs_options[no_of_custom_images]\" value=\"1\">
  <input type=\"text\" name=\"wpcs_options[slide_image1]\" 
value=\"&quot;>&lt;script>alert(1)&lt;/script>\">
  <input type=\"submit\">
</form>
If using a browser without reflected XSS mitigation (e.g. Chrome) the admin 
user will see “1” in an alert box, otherwise a refresh of the page is required 
before the JavaScript is executed.

Mitigations
================
Disable the plugin until a new version is released that fixes this bug
At the time of publishing no fix is available and the plugin has been removed 
from the plugin directory

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our 
disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@xxxxxxx to acknowledge this report if you 
received it via a third party (for example, plugins@xxxxxxxxxxxxx) as they 
generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this 
report with 14 days.

Timeline
================

2014-10-08: Discovered
2014-12-16: Reported to vendor via email form at 
http://www.snilesh.com/contact-me/
2014-12-16: Requested CVE
2015-01-07: Vendor responded
2015-01-09: Vendor chased
2015-04-09: Vendor had given assurances that a fix would be available, and was 
given multiple extensions to do so, but by this point they had stopped 
responding. Emailed plugins@xxxxxxxxxxxxx requesting a takedown.
2015-04-16: Confirmed that the plugin is no longer on the directory. Published.



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
          


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/