PT-2015-4265 · WordPress · Cardoza-Facebook-Like-Box

Published 2015-01-05 · Updated 2015-01-06 · CVE-2014-9524

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cardoza-facebook-like-box plugin versions prior to 2.8.3 for WordPress

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests, potentially leading to changes in plugin settings or cross-site scripting (XSS) attacks. The XSS attacks can be conducted via the frm title, frm url, frm border color, frm width, or frm height parameter in the "slug for fb like box" page to "wp-admin/admin.php".

Recommendations For versions prior to 2.8.3, update the cardoza-facebook-like-box plugin to version 2.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings page to minimize the risk of exploitation. Avoid using the vulnerable parameters frm title, frm url, frm border color, frm width, or frm height in the affected page until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-9524

Affected Products

Cardoza-Facebook-Like-Box

References · 5

• 🔥 http://secunia.com/advisories/61557 · Exploit
• 🔥 http://packetstormsecurity.com/files/129506/WordPress-Facebook-Like-Box-2.8.2-CSRF-XSS.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9524 · Security Note
• https://wordpress.org/plugins/cardoza-facebook-like-box/changelog · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9524 · Note