← Advisories

WordPress MiwoFTP Plugin 1.0.5 Multiple CSRF XSS Vulnerabilities

Medium
Advisory ID
ZSL-2015-5241
Release Date
14 April 2015
Vendor
Affected Version
1.0.5
CVE
N/A
Tested On
Apache 2.4.10 (Win32), PHP 5.6.3, MySQL 5.6.21
Summary

MiwoFTP is a smart, fast and lightweight file manager plugin that operates from the back-end of WordPress.

Description

MiwoFTP WP Plugin suffers from multiple cross-site request forgery and xss vulnerabilities. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed to several GET/POST parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Proof of Concept
Disclosure Timeline
24.03.2015Vulnerability discovered.
25.03.2015Vendor contacted.
25.03.2015Vendor responds asking more details.
26.03.2015Sent details to the vendor.
27.03.2015Vendor forwarded details to developers.
30.03.2015Vendor confirms vulnerability scheduling patch by end of week.
31.03.2015Replied to the vendor.
09.04.2015Asked vendor for status update.
12.04.2015No reply from the vendor.
13.04.2015Asked vendor for status update.
13.04.2015Vendor replies promising patch by end of week.
14.04.2015Vendor releases version 1.0.6 to address these issues.
14.04.2015Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
14.04.2015Initial release
16.04.2015Added reference [2], [3], [4] and [5]
22.04.2015Added reference [6] and [7]