E-goi Smart Marketing SMS/Newsletters Forms Plugin 1.1.1 on WordPress egoi-for-wp-form_egoi.php url cross site scripting

Summaryinfo

A vulnerability classified as problematic was found in E-goi Smart Marketing SMS and Newsletters Forms Plugin 1.1.1 on WordPress. The affected element is an unknown function of the file admin/partials/custom/egoi-for-wp-form_egoi.php. The manipulation of the argument url with the input "" onload="alert('XSS')"> as part of Parameter results in cross site scripting. This vulnerability is identified as CVE-2017-18010. The attack can be executed remotely. Additionally, an exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in E-goi Smart Marketing SMS and Newsletters Forms Plugin 1.1.1 on WordPress (Marketing Software). Affected is an unknown function of the file admin/partials/custom/egoi-for-wp-form_egoi.php. The manipulation of the argument url with the input value "" onload="alert('XSS')"> leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

The E-goi Smart Marketing SMS and Newsletters Forms plugin 1.1.1 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.

The weakness was released 12/05/2017 by Ricardo Sanchez as File 145217 as confirmed advisory (Packetstorm). The advisory is shared for download at packetstormsecurity.com. This vulnerability is traded as CVE-2017-18010 since 01/01/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007. The advisory points out:

Smart Marketing SMS and Newsletters Forms is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

A public exploit has been developed by Ricardo Sanchez in HTTP POST Request and been published immediately after the advisory. The exploit is shared for download at packetstormsecurity.com. It is declared as proof-of-concept. By approaching the search of inurl:admin/partials/custom/egoi-for-wp-form_egoi.php it is possible to find vulnerable targets with Google Hacking. The code used by the exploit is:

POST /wordpress/wp-content/plugins/smart-marketing-for-wp/admin/partials/custom/egoi-for-wp-form_egoi.php HTTP/1.1
Host: localhost
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: es-ES,es;q=0.9
Cookie:
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

url="" onload="alert('XSS')">

Upgrading to version 2.0.0 eliminates this vulnerability. The upgrade is hosted for download at wordpress.org.

Further details are available at security-database.com. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Marketing Software

Vendor

• E-goi

Name

• Newsletters Forms Plugin
• Smart Marketing SMS

Version

• 1.1.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion