WordPress WP Image Zoom plugin version 1.23 suffers from a denial of service vulnerability.
463d616287fd5a1b077c96424563a0b3Details
================
Software: WP Image Zoom
Version: 1.23
Homepage: http://wordpress.org/plugins/wp-image-zoooom/
Advisory report: https://advisories.dxw.com/advisories/wp-image-zoom-dos/
CVE: Awaiting assignment
CVSS: 7.5 (High; AV:N/AC:L/Au:S/C:N/I:P/A:C)
Description
================
WP Image Zoom allows anybody to cause denial of service
Vulnerability
================
WP Image Zoom includes an AJAX action which allows any logged in user to set any option to a1a. This means that any logged in user can cause a denial of service for all WP URLs by setting the atemplatea option to a1a.
Additionally, this vulnerability can be triggered via CSRF meaning that anybody who can convince a logged in user to follow a link can also cause a denial of service.
Proof of concept
================
Press the submit button in the following HTML snippet:
<form action=\"http://localhost/wp-admin/admin-ajax.php\" method=\"POST\">
<input type=\"text\" name=\"action\" value=\"iz_dismiss\">
<input type=\"text\" name=\"option\" value=\"template\">
<input type=\"submit\">
</form>
This will set the template option to 1 causing fatal errors for any WordPress URL.
In a real attack the form could be set to autosubmit so no user interaction is required except for following a link.
Mitigations
================
Upgrade to version 1.24 or later.
Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/
Please contact us on [email protected] to acknowledge this report if you received it via a third party (for example, [email protected]) as they generally cannot communicate with us on your behalf.
This vulnerability will be published if we do not receive a response to this report with 14 days.
Timeline
================
2018-03-20: Discovered
2018-03-27: Reported to author via https://www.silkypress.com/contact/
2018-03-27: Vendor responded
2018-03-29: Vendor reported issue fixed in version 1.24
Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.