Multiple XSS in eShop for Wordpress

Product: eShop for Wordpress Vendor: Rich Pedley ( http://wordpress.org/extend/plugins/eshop/ ) Vulnerable Version: 6.2.8 and probably prior Tested on: 6.2.8 Vendor Notification: 20 July 2011 Vulnerability Type: XSS (Cross Site Scripting) Status: Fixed by Vendor Risk level: Medium Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ \ ) Vulnerability Details: High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in \ eShop for Wordpress, which can be exploited to perform cross-site scripting attacks \ against logged-in Wordpress Administrator. 1) Input passed via the "eshoptemplate" GET parameter to /wp-admin/admin.php (when \ "page" is set to "eshop-templates.php") is not properly sanitised before being \ returned to the user. This can be exploited to execute arbitrary HTML and script code \ in a administrator's browser session in context of affected website. The following PoC code is available: http://[host]/wp-admin/admin.php?page=eshop-templates.php&eshoptemplate=%22%3E%3Cscrip \ t%3Ealert%28document.cookie%29;%3C/script%3E 2) Input passed via the "action" GET parameter to /wp-admin/admin.php (when "page" is \ set to "eshop-orders.php") is not properly sanitised before being returned to the \ user. This can be exploited to execute arbitrary HTML and script code in a \ administrator's browser session in context of affected website. The following PoC code is available: http://[host]/wp-admin/admin.php?page=eshop-orders.php&view=1&action=%22%3E%3Cscript%3 \ Ealert%28document.cookie%29;%3C/script%3E 3) Input passed via the "viewemail" GET parameter to /wp-admin/admin.php (when "page" \ is set to "eshop-orders.php") is not properly sanitised before being returned to the \ user. This can be exploited to execute arbitrary HTML and script code in a \ administrator's browser session in context of affected website. http://[host]/wp-admin/admin.php?page=eshop-orders.php&viewemail=%22%3E%3Cscript%3Eale \ rt%28document.cookie%29;%3C/script%3E Solution: Upgrade to the most recent version