Soundy Background Music XSS Vulnerability

## FULL DISCLOSURE

#Product : Soundy Background Music
#Exploit Author : Rahul Pratap Singh
#Version : 3.1
#Home page Link : https://wordpress.org/plugins/soundy-background-music/
#Website : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94
#Date : 12/3/2016

XSS Vulnerability:

—————————————-
Description:
—————————————-
“war_soundy_audio_volume” parameter is not sanitized that leads to Reflected XSS.

—————————————-
Vulnerable Code:
—————————————-

soundy.php
1462-1473
if( $audio_volume_def == ‘default’ )
{
$audio_volume = ‘default’;
}
else
{
$audio_volume = $_POST[ ‘war_soundy_audio_volume’ ];
}
update_post_meta( $post_id,
                 ‘war_soundy_audio_volume’,
                 $audio_volume );

—————————————-
POC:
—————————————-
Soundy_Background_Music_XSS

Fix:
Update to 3.2

Vulnerability Disclosure Timeline:
→ March  3, 2016  – Bug discovered, initial report to WordPress
→ March  7, 2016  – No response, Report sent again.
→ March  8, 2016  – WordPress response, plugin taken down
→ March 10, 2016  – Vendor deployed a patch

#######################################
#                    CTG SECURITY SOLUTIONS                          #
#                www.ctgsecuritysolutions.com                        #
#######################################

Pub Ref:
https://wordpress.org/plugins/soundy-background-music/changelog/

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s