Multiple vulnerabilities in Register Plus Redux for WordPress

["MustLive" <mustlive () websecurity com ua>]

Hello list!

I want to warn you about multiple Cross-Site Scripting vulnerabilities in
plugin Register Plus Redux for WordPress.

-------------------------
Affected products:
-------------------------

Register Plus Redux is a fork of Register Plus, so many of the holes in it
(as from these ones, as from previous ones) are similar to holes in Register
Plus.

Vulnerable are versions of plugin Register Plus Redux 3.7.3 and previous
versions. Version 3.6.1 was checked, but all versions should be vulnerable,
because the developer didn't fix any vulnerability (not these ones, nor last
year's ones).

----------
Details:
----------

XSS (persistent) (WASC-08):

There are many persistent XSS vulnerabilities in plugin options
(http://site/wp-admin/options-general.php?page=register-plus-redux) in
fields: Enable Password Strength Meter (Short, Bad, Good, Strong) Grace
Period, Invitation Code, Disclaimer Title, Disclaimer Content, Agreement
Text, License Title, License Content, Agreement Text, Privacy Policy Title,
Privacy Policy Content, Agreement Text, Required Field Style Rules, Custom
Field, Extra Options, Date Format, First Selectable Date, Default Year,
Customize User Notification Email (From Email, From Name, Subject, User
Message, Login Redirect URL), Customize Admin Notification Email (From
Email, From Name, Subject, Admin Message), Custom Register CSS, Custom Login
CSS.

The code will execute at plugin options page and/or at registration page
(http://site/wp-login.php?action=register).

At that at plugin options page the protection against CSRF is used, so it
needs to use reflected XSS for bypassing it and conducting of persistent XSS
attack.

I'll note, that there is persistent XSS in dash_widget.php (as in Register
Plus), where the code will execute at visiting of Dashboard page. But widget
isn't using in Register Plus Redux, so this attack isn't possible (until the
author will not add widget support, because file dash_widget.php is bundled
with plugin).

------------
Timeline:
------------

2011.04.18 - announced at my site.
2011.04.21 - informed developer.
2011.04.22 - informed developer on another e-mail.
2011.08.05 - disclosed at my site.

Taking into account, that the author of the plugin didn't fix these holes
(as previous ones), then users of the plugin need to fix these holes by
themselves.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/5089/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/