[FD] WP Image Zoom allows anybody to cause denial of service (WordPress plugin)

[dxw Security <harry@xxxxxxx>]

Details
================
Software: WP Image Zoom
Version: 1.23
Homepage: http://wordpress.org/plugins/wp-image-zoooom/
Advisory report: https://advisories.dxw.com/advisories/wp-image-zoom-dos/
CVE: Awaiting assignment
CVSS: 7.5 (High; AV:N/AC:L/Au:S/C:N/I:P/A:C)

Description
================
WP Image Zoom allows anybody to cause denial of service

Vulnerability
================
WP Image Zoom includes an AJAX action which allows any logged in user to set 
any option to “1”. This means that any logged in user can cause a denial of 
service for all WP URLs by setting the “template” option to “1”.
Additionally, this vulnerability can be triggered via CSRF meaning that anybody 
who can convince a logged in user to follow a link can also cause a denial of 
service.

Proof of concept
================
Press the submit button in the following HTML snippet:
<form action=\"http://localhost/wp-admin/admin-ajax.php\"; method=\"POST\">
 <input type=\"text\" name=\"action\" value=\"iz_dismiss\">
 <input type=\"text\" name=\"option\" value=\"template\">
 <input type=\"submit\">
</form>
This will set the template option to 1 causing fatal errors for any WordPress 
URL.
In a real attack the form could be set to autosubmit so no user interaction is 
required except for following a link.

Mitigations
================
Upgrade to version 1.24 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our 
disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@xxxxxxx to acknowledge this report if you 
received it via a third party (for example, plugins@xxxxxxxxxxxxx) as they 
generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this 
report with 14 days.

Timeline
================

2018-03-20: Discovered
2018-03-27: Reported to author via https://www.silkypress.com/contact/
2018-03-27: Vendor responded
2018-03-29: Vendor reported issue fixed in version 1.24



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
            


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/