Securin Zero-Days

The following vulnerability was discovered in Post-Duplicator Plugin 2.23.

Issue: Stored Cross-Site Scripting

Note: Here, localhost has been used for testing the application locally.

1. Login to the WordPress application.

2. Install Post Duplicator Plugin.

3. Go to the ‘Tools’ menu of WordPress and click on the ‘Post Duplicator’ button.

Figure 01: Post Duplicator Settings Page

4. Enter the payload – Duplicate Post”><script>alert(document.cookie)</script> in the ‘Duplicate Title’ field (mtphr_post_duplicator_settings[title] parameter).

Figure 02: Entering  XSS payload in the  ‘Duplicate Title’ field

5. Enter the payload – Hello World!”><script>alert(document.cookie)</script> in the ‘Duplicate Slug’ field (mtphr_post_duplicator_settings[slug] parameter).

Figure 03: Entering  XSS payload in the  ‘Duplicate Slug’ field

6. Click on the ‘Save Changes’ button to save changes.

7. Go to the Post Duplicator Settings page at tools.php?page=mtphr_post_duplicator_settings_menu

Figure 04: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.

8. Another use case of this vulnerability is when the post is duplicated after injecting the XSS payload in the settings page.

Figure 05: Duplicate the “Hello world!” post

9. Once the post is duplicated, the title of the duplicated post will append the name we specified in the mtphr_post_duplicator_settings[title] parameter.

Figure 06: Duplicated post with XSS Payload

10. Now navigate to the application root to view the posts.

Figure 07: Injected XSS payload is executed displaying an alert box with the contents of the user’s cookies.

Figure 08: The default cross-site scripting mitigation setting in wp.config file to prevent cross-site scripting attacks