The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with medium or high required user inter action. The bugs are located on server side in the Limit Login Attempts, Exception Handling Error & Intrusion Detection module with the bound vulnerable email address & error parameter. Successful exploitation can result in wordpress application account steal, client side phishing & client-side content request manipulation. Exploitation requires medium or high user inter action & without privileged web application user account.
Proof of Concept:
The persistent vulnerability can be exploited by remote attackers with low required user inter action & low privileged
application user account. For demonstration or reproduce ...
Inject the following example string to the application input (persistent) or parameter (client side)
String: >"<iframe src=http://www.vulnerability-lab.com></iframe>
Review: Exception Handling
<div class="error" style="text-align: center;"><p style="color: red; font-size: 14px; font-weight:
bold;">Attention !</p><p>
Please add this site now to your <a target="_blank" href="http://managewp.com/wp-admin";>ManageWP.com</a> account.
Or deactivate the Worker plugin to avoid <a target="_blank" href="http://managewp.com/user-guide/security";>security
issues</a>.
</p></div><div id="message" class="error"><p>Login time period needs to be aan integer greater than 0.</p></div>
<div id="message" class="error"><p>\"><[PERSISTENT INJECTED SCRIPT CODE!]")' <="" is=""
not="" a="" valid="" ip.<="" p=""></div>
Disclosure Timeline:
2012-08-21: Public Disclosure
