WordPress Plugin Quick Contact Form 6.0 - Persistent Cross-Site Scripting

EDB-ID:

28808

CVE:



Author:

Zy0d0x

Type:

webapps


Platform:

PHP

Date:

2013-10-08


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

===============================================================================
|                                                                             |
                         ____                     _ __
              ___  __ __/ / /__ ___ ______ ______(_) /___ __
             / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // /
            /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, /
                                                     /___/ team

                          PUBLIC SECURITY ADVISORY
|                                                                             |
===============================================================================


TITLE
=====

Quick Contact Form - Persistent Cross Site Scripting Vulnerability


AUTHOR
======

Zy0d0x


DATE
====

10/06/2013

VENDOR
======

Quick Plugins - http://quick-plugins.com/


AFFECTED PRODUCT
================

Quick Contact Form  Wordpress Plugin Version 6.0 possibly earlier


VULNERABILITY CLASS
===================

Cross-Site Scripting


DESCRIPTION
===========


Quick Contact Form suffers from a persistent Cross-Site Scripting vulnerability due to a lack
of input validation and output sanitization of the qcfname4 paramater.
Other input fields are also effective to reflective cross site scripting.


PROOF OF CONCEPT
================

Enter the following into the field where Quick Contact Form requests a Message.

--- SNIP ---

"><script>alert(String.fromCharCode(90,121,48,100,48,120))</script><

--- SNIP ---

If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard.


IMPACT
======

An attacker could potentially hijack session authentication tokes of remote users and leverage the
vulnerability to increase the attack vector to the underlying software and operating system of the victim.


THREAT LEVEL
============

High


STATUS
======

Fixed update to version 6.1


DISCLAIMER
==========

nullsecurity.net hereby emphasize, that the information which is published here are
for education purposes only. nullsecurity.net does not take any responsibility for
any abuse or misusage!