Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities

##############################################################################
Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities

author...............: Mehmet Ince
twitte...............: https://twitter.com/#!/mmetince
mail.................: mehmet.ince@bga.com.tr
software link........: http://www.zingiri.com
affected versions....: tested on 2.3.0 and 2.4.0
# Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS
Vulnerabilities
# Google Dork:
# Date: 26 Apr 2012
# Author: Mehmet INCE
# Software Link:
http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.0.zip
# Version: 2.4.0 and older.
# Tested on: version of 2.3.0 and 2.4.0 with Ubuntu 11.10 Server with
Firefox browser.
##############################################################################
/*
## BASIC XSS
PS: Exploitable without Authentication

plugins/zingiri-web-shop/zing.inc.php

line at 401.

if ($process=='content' && $page!='ajax' && $page!='downldr') echo '<div
class="zing_ws_page" id="zing_ws_'.$_GET['page'].'">';

Exploit:
http://localhost/wordpress/?page=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

'page' variable isn't properly sanitized before being used.

## STORED XSS
PS: Attacker should be logged for exploit.
./fws/pages-front/onecheckout.php

line 27-29
if (!empty($_POST['notes'])) {
$notes=$_POST['notes'];
}

and line 348
<textarea name="notes" rows="5" style="width: 100%"><?php echo
$notes;?>&lt;/textarea&gt;<br />

'notes' variable isn't properly sanitized before being used.

That's very basic XSS vulnerabilities. But you dont need use fishing attack
to target webpage's administrator. That application insert datas to
database with that form. After your malicious code posted up, your
javascrip code inserted to database with $_POST['notes'] variable. When
administrator wanna see list of ordered items list. Javascript codes will
come from database and start working on Authenticated admin user side.
After that You can use browser keylogger with BT5 tools or can usee cookie
grabber.
*/

step 1: Login to wordpress.

step 2: Go to "Shop" menu. It's should be stay at banner.

http://6.6.6.102/wordpress/?page_id=14

step 3: Than you'll see list ot items. Click one of them.

http://6.6.6.102/wordpress/?page=details&prod=2&cat=1&page_id=14

step 4: You can pass that form action. That wont be problem..! Click to
"Order" button.

step 5: There is confirmation about the Shopping. Click "checkout" to pass
that page.

step 6: It's final stage. Put you javascript payload to "Additional
comments/questions" form. After you click checkout button, that form will
get all of these input data with POST method.

step 7: Click to "Checkout"