Multiple vulnerabilities in Register Plus for WordPress

["MustLive" <mustlive () websecurity com ua>]

Hello list!

I want to warn you about multiple Cross-Site Scripting vulnerabilities in
plugin Register Plus for WordPress.

-------------------------
Affected products:
-------------------------

Vulnerable are versions of plugin Register Plus 3.5.1 and previous versions.

----------
Details:
----------

XSS (persistent) (WASC-08):

At turned on options Enable Invitation Code(s) and Enable Invitation
Tracking Dashboard Widget and set code
<script>alert(document.cookie)</script> in example of Invitation Code at
plugin options page
(http://site/wp-admin/options-general.php?page=register-plus), the code will
execute at visiting of Dashboard page (http://site/wp-admin/index.php). The
persistent XSS vulnerability itself exists in dash_widget.php.

There are many persistent XSS vulnerabilities in plugin options
(http://site/wp-admin/options-general.php?page=register-plus) in fields:
Enable Password Strength Meter (Short, Bad, Good, Strong) Grace Period,
Invitation Code, Disclaimer Title, Disclaimer Content, Agreement Text,
License Title, License Content, Agreement Text, Privacy Policy Title,
Privacy Policy Content, Agreement Text, Required Field Style Rules, Custom
Field, Extra Options, Date Format, First Selectable Date, Default Year,
Customize User Notification Email (From Email, From Name, Subject, User
Message, Login Redirect URL), Customize Admin Notification Email (From
Email, From Name, Subject, Admin Message), Custom Register CSS, Custom
Login CSS.

The code will execute at plugin options page and/or at registration page
(http://site/wp-login.php?action=register).

At that at plugin options page the protection against CSRF is used, so it
needs to use reflected XSS for bypassing it and conducting of persistent XSS
attack.

------------
Timeline:
------------

2011.04.16 - announced at my site.
2011.04.18 - informed developer.
2011.08.03 - disclosed at my site.

Taking into account, that this plugin is no more supported by developer,
then users of the plugin need to fix these holes by themselves.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/5086/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/