Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting EDB-34336 · webapps · Aug 14, 2014
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://wordpress.org/plugins/disqus-comment-system/other_notes
- http://packetstormsecurity.com/files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html
- 20140812 Multiple Vulnerabilities in Disqus for Wordpress v2.7.5 mailing-list
- http://packetstormsecurity.com/files/127852/Disqus-2.7.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
- https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin
- https://gist.github.com/nikcub/cb5dc7a5464276c8424a
- disqus-wordpress-manage-csrf(95288) vdb-entry
- 69205 vdb-entry
- 34336 exploit
- disqus-wordpress-nonce-sec-bypass(95289) vdb-entry