Security Flaws in the backend

dealertrend / wordpress-plugin-inventory-api

This is the new WordPress plugin for DealerTrend, Inc. It will interface with their Automotive Information System's API.

http://www.dealertrend.com

GNU General Public License v2.0

22 stars 6 forks source link

Security Flaws in the backend #4

Closed Ryuske closed 13 years ago

Ryuske commented 13 years ago

Under /wp-admin/admin.php?page=dealertrend_api#feeds

If you change Company ID to "><script>alert(1)</script> it will execute (may have to do it twice, not sure).

I'm pretty sure all fields here are exploitable to XSS, as well as SQLi. They're persistent, meaning you're also vulnerable to cookie stealing and such.

grok commented 13 years ago

Fixed: https://github.com/dealertrend/wordpress-plugin-inventory-api/commit/a253e607dab4d503412e0f058a1f197383bd3f24