wp-plugin : wp-symposium – A10-Unvalidated Redirects and Forwards

 

Plugin Details

 

Plugin Name : wp-symposium

 

Effected Version : 13.12 (and most probably lower version's if any)

 
Vulnerability : A10-Unvalidated Redirects and Forwards
 
Identified by : Anant Shrivastava

 

 

Technical Details

 

Minimum Level of Access Required : Contributor

 

PoC - (Proof of Concept) :

 
http://localhost/wp-content/plugins/wp-symposium/invite.php?u=http://www.google.com

 

Vulnerable Parameter : u

 

The vulnerability affects when the user is not logged in.

 

Fixed in : 14.02

 

Trac Changelog : https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=822756%40wp-symposium&old=820190%40wp-symposium&sfp_email=&sfph_mail=

 

Disclosure Timeline

 

Vendor Contacted : 2013-12-15

 
Plugin Status : Updated on 2014-01-28
 
Public Disclosure : July 7, 2014
 
CVE Number : Not assigned yet

 
Plugin Description :
 
**WP Symposium turns a WordPress website into a Social Network! It is a WordPress plugin that provides a forum, activity (similar to Facebook wall), member directory, private mail, notification panel, chat windows, profile page, social widgets, activity alerts, RSS activity feeds, Groups, Events, Gallery, Facebook Connect and Mobile support! You simply choose which you want to activate! Certain features are optional to members to protect their privacy.**

For developers, there are a growing number of WordPress hooks and filters, along with classes, WP Symposium functions and Javascript variables.

Note: The Core WP Symposium plugin from WordPress.org is free (that includes profile, activity, forum, mail, member directory and widgets) - additional "Bronze" WP Symposium features can be purchased. They are included in the download so you can try them out on your site, and also at the request of existing users so that all get updated together.

Find out more, and try it out on our own social network at www.wpsymposium.com.

*Three steps to create a Social Network website*

1. Download WordPress
2. Install WP Symposium

erm, sorry - only two steps.

*What do you get?*

A set of features, that can be used individually or all together, to produce a social networking website built on WordPress.

You can activate a member profile page with activity wall and posts/replies; member profile photos (avatars), make friendships (and followers), activate a forum, add a directory of members and send/receive internal (private) messaging.

And there are "Bronze" features for even more functionality - live chat windows, Groups, Events, Facebook Shared Status, Photo Albums and Mobile Access.

These are included in the package installation so you can try them on your site (a small banner is shown while you are trying out the Bronze plugins which is removed with an Activation Code if you subscribe to the Bronze subscription at www.wpsymposium.com/membership).

Oh, and you also get widgets, with more to come, including latest new members, friends status updates, who is online and latest forum posts.

*Can I change the layout and styles?*

Certainly can! Templates are provided for you to change the layout, and an easy-to-use style configuration (or way to enter CSS if you prefer) is provided to change the styles.

*How is it configured?*

WP Symposium will work with any WordPress theme! No complicated theme development, and no complicated styles - you can even pick the colour scheme in the WordPress admin area!

Via crowdin website at www.crowdin.net/project/symposium, a growing number of translations are being maintained by an active user base, so running WP Symposium in a different language is easily set up.

*What else is there?*

Loads! Smilies, loves AJAX, an installation "health check" page, templates for changing the page layout, options for just about everything... the list goes on!

Find out more, and try it out on our own social network at www.wpsymposium.com.

*Can I see what features are coming next?*

The development roadmap is directed by users! Anyone can see what's coming next, and Bronze members can vote, at http://www.wpsymposium.com/voting

*Where can I get support?*

At www.wpsymposium.com forum, and for subscribers via a helpdesk.

Leave a Reply

Your email address will not be published. Required fields are marked *