Wordpress Quick Contact Form Plugin 6.0 - Persistent XSS

===============================================================================
|**************************************************************************** |
*************************____******************** _ __
**************___* __ __/ / /__ ___ ______ ______(_) /___ __
*************/ _ \/ // / / (_-</ -_) __/ // / __/ / __/ // /
************/_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, /
*****************************************************/___/ team
*
**************************PUBLIC SECURITY ADVISORY
|**************************************************************************** |
===============================================================================
*
*
TITLE
=====
*
Quick Contact Form - Persistent Cross Site Scripting Vulnerability
*
*
AUTHOR
======
*
Zy0d0x
*
*
DATE
====
*
10/06/2013
*
VENDOR
======
*
Quick Plugins - http://quick-plugins.com/
*
*
AFFECTED PRODUCT
================
*
Quick Contact Form* Wordpress Plugin Version 6.0 possibly earlier
*
*
VULNERABILITY CLASS
===================
*
Cross-Site Scripting
*
*
DESCRIPTION
===========
*
*
Quick Contact Form suffers from a persistent Cross-Site Scripting vulnerability due to a lack
of input validation and output sanitization of the qcfname4 paramater.
Other input fields are also effective to reflective cross site scripting.
*
*
PROOF OF CONCEPT
================
*
Enter the following into the field where Quick Contact Form requests a Message.
*
--- SNIP ---
*
">**********alert(String.fromCharCode(90,121,48,100,48,120))</script><
*
--- SNIP ---
*
If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard.
*
*
IMPACT
======
*
An attacker could potentially hijack session authentication tokes of remote users and leverage the
vulnerability to increase the attack vector to the underlying software and operating system of the victim.
*
*
THREAT LEVEL
============
*
High
*
*
STATUS
======
*
Fixed update to version 6.1
*
*
DISCLAIMER
==========
*
nullsecurity.net hereby emphasize, that the information which is published here are
for education purposes only. nullsecurity.net does not take any responsibility for
any abuse or misusage!