CVE-2015-10127 (PHP, published 2023-12-26T17:15Z)
Description: value: A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/pluscaptcha
Files changed:
PlusCaptcha.php
external/comment-form-inline-errors.php
library/admin.php
library/public.php
library/shortcode-and-others.php
readme.txt
template/admin-options-contactform.php
template/admin-options.php
template/admin-register.php
Commit message: Solver XSS

git-svn-id: https://plugins.svn.wordpress.org/pluscaptcha/trunk@1094241 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 2.0.6
            if(!is_admin() && !empty($_POST['comment_post_ID']) && is_numeric($_POST['comment_post_ID'])){
                wp_safe_redirect(get_permalink($_POST['comment_post_ID']) . '#formError', 302);
# Clean
# Limpiar data
function tags($tags){  
	$tags = strip_tags($tags);  
	$tags = stripslashes($tags);  
	$tags = htmlentities($tags);
	$tags = addslashes($tags);
	return trim($tags);  
} 
  if ((isset($_POST[$hidden_field_name])) && ($_POST[$hidden_field_name] == 'Y')) {
	  update_option('PlusCaptcha_feedback_quemejoraria', $_POST["PlusCaptcha_feedback_quemejoraria"]);
  $website = json_encode(empty($_POST['website']) ? "http://{$_SERVER['SERVER_NAME']}/" : $_POST['website']);
  $email = json_encode($_POST['email']);
  if (isset($_POST['language'])) {
    $language = (int) $_POST['language'];
  if (isset($_POST['category'])) {
    $category = (int) $_POST['category'];
  if (isset($_POST['site_category'])) {
    $site_category = (int) $_POST['site_category'];
  if (isset($_POST['gender'])) {
    $gender = (int) $_POST['gender'];
  if ((!$ignore_post) && (isset($_POST[$hidden_field_name])) && ($_POST[$hidden_field_name] == 'Y')) {
      $opt_val = isset($_POST[$opt_name]) ? $_POST[$opt_name] : null;
  $plscptf_options_submit['plscptf_user_email'] = $_REQUEST['plscptf_user_email'];
  $plscptf_options_submit['plscptf_custom_email'] = $_REQUEST['plscptf_custom_email'];
  $plscptf_options_submit['plscptf_select_email'] = $_REQUEST['plscptf_select_email'];
  $plscptf_options_submit['plscptf_additions_options'] = isset($_REQUEST['plscptf_additions_options']) ? $_REQUEST['plscptf_additions_options'] : 0;
    $plscptf_options_submit['plscptf_send_copy'] = isset($_REQUEST['plscptf_send_copy']) ? $_REQUEST['plscptf_send_copy'] : 0;
    $plscptf_options_submit['plscptf_mail_method'] = $_REQUEST['plscptf_mail_method'];
    $plscptf_options_submit['plscptf_from_field'] = $_REQUEST['plscptf_from_field'];
    $plscptf_options_submit['plscptf_display_add_info'] = isset($_REQUEST['plscptf_display_add_info']) ? 1 : 0;
    $plscptf_options_submit['plscptf_change_label'] = isset($_REQUEST['plscptf_change_label']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_sent_from'] = isset($_REQUEST['plscptf_display_sent_from']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_date_time'] = isset($_REQUEST['plscptf_display_date_time']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_coming_from'] = isset($_REQUEST['plscptf_display_coming_from']) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_user_agent'] = isset($_REQUEST['plscptf_display_user_agent']) ? 1 : 0;
      $plscptf_options_submit['plscptf_name_label'] = isset($_REQUEST['plscptf_name_label']) ? $_REQUEST['plscptf_name_label'] : $plscptf_options_submit['plscptf_name_label'];
      $plscptf_options_submit['plscptf_email_label'] = isset($_REQUEST['plscptf_email_label']) ? $_REQUEST['plscptf_email_label'] : $plscptf_options_submit['plscptf_email_label'];
      $plscptf_options_submit['plscptf_subject_label'] = isset($_REQUEST['plscptf_subject_label']) ? $_REQUEST['plscptf_subject_label'] : $plscptf_options_submit['plscptf_subject_label'];
      $plscptf_options_submit['plscptf_message_label'] = isset($_REQUEST['plscptf_message_label']) ? $_REQUEST['plscptf_message_label'] : $plscptf_options_submit['plscptf_message_label'];
    $plscptf_options_submit['plscptf_action_after_send'] = $_REQUEST['plscptf_action_after_send'];
    $plscptf_options_submit['plscptf_thank_text'] = $_REQUEST['plscptf_thank_text'];
    $plscptf_options_submit['plscptf_redirect_url'] = $_REQUEST['plscptf_redirect_url'];
    if ( isset($_REQUEST['PlusCaptcha_form_contact']) ) {
		'sckey'		=> ( isset( $_POST[ 'sckey' ] ) ? $_POST[ 'sckey' ] : '' ),
		'scvalue'	=> ( isset( $_POST[ 'scvalue' ] ) ? $_POST[ 'scvalue' ] : '' )
	if ( !empty( $_POST ) && get_result(simpleSessionGet("contacto", "")) == false ) {
	if ( $_POST['stage'] == 'validate-user-signup' ) {
# Clean
# Limpiar data
function tags($tags){  
	$tags = strip_tags($tags);  
	$tags = stripslashes($tags);  
	$tags = htmlentities($tags);
	$tags = addslashes($tags);
	return trim($tags);  
} 
    $page_url = ( isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" ? "https://" : "http://" ) . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"];
    $name = isset($_REQUEST['plscptf_contact_name']) ? $_REQUEST['plscptf_contact_name'] : "";
    $email = isset($_REQUEST['plscptf_contact_email']) ? $_REQUEST['plscptf_contact_email'] : "";
    $subject = isset($_REQUEST['plscptf_contact_subject']) ? $_REQUEST['plscptf_contact_subject'] : "";
    $message = isset($_REQUEST['plscptf_contact_message']) ? $_REQUEST['plscptf_contact_message'] : "";
    $send_copy = isset($_REQUEST['plscptf_contact_send_copy']) ? $_REQUEST['plscptf_contact_send_copy'] : "";
    if (isset($_REQUEST['plscptf_contact_action'])) {
    if ("" != $_REQUEST['plscptf_contact_name'])
    if ("" != $_REQUEST['plscptf_contact_email'] && preg_match("/^(?:[a-z0-9]+(?:[a-z0-9\-_\.]+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})$/i", trim($_REQUEST['plscptf_contact_email'])))
    if ("" != $_REQUEST['plscptf_contact_subject'])
    if ("" != $_REQUEST['plscptf_contact_message'])
      $subject = $_REQUEST['plscptf_contact_subject'];
        $form_action_url = 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
        $form_action_url = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
        $userdomain = gethostbyaddr($_SERVER['REMOTE_ADDR']);
							<td>' . __('Sent from (ip address)', 'PlusCaptcha') . ':</td><td>' . $_SERVER['REMOTE_ADDR'] . " ( " . $userdomain . " )" . '</td>
							<td>' . __('Using (user agent)', 'PlusCaptcha') . ':</td><td>' . plscptf_clean_input($_SERVER['HTTP_USER_AGENT']) . '</td>
						<td width="160">' . __("Name", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_name'] . '</td>
						<td>' . __("Email", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_email'] . '</td>
						<td>' . __("Subject", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_subject'] . '</td>
						<td>' . __("Message", 'PlusCaptcha') . '</td><td>' . $_REQUEST['plscptf_contact_message'] . '</td>
        $headers .= 'From: ' . $_REQUEST['plscptf_contact_email'] . "\r\n";
        if (isset($_REQUEST['plscptf_contact_send_copy']) && $_REQUEST['plscptf_contact_send_copy'] == 1)
          wp_mail($_REQUEST['plscptf_contact_email'], stripslashes($subject), stripslashes($message), $headers, $attachments);
        $headers .= 'From: ' . $_REQUEST['plscptf_contact_email'] . "\r\n";
        if (isset($_REQUEST['plscptf_contact_send_copy']) && $_REQUEST['plscptf_contact_send_copy'] == 1)
          @mail($_REQUEST['plscptf_contact_email'], stripslashes($subject), stripslashes($message), $headers);
Version: 2.0.6
<?php 
		.'quemejorar='.substr(str_replace(".","[dot]",urlencode($_POST["PlusCaptcha_feedback_quemejoraria"])),0,299).

Fixed code:
Version: 2.0.14
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

            if(!is_admin() && tags(!empty($_POST['comment_post_ID'])) && tags(is_numeric($_POST['comment_post_ID']))){
                wp_safe_redirect(get_permalink(tags($_POST['comment_post_ID'])) . '#formError', 302);
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}
  if ((tags(isset($_POST[$hidden_field_name]))) && (tags($_POST[$hidden_field_name]) == 'Y')) {
	  update_option('PlusCaptcha_feedback_quemejoraria', tags($_POST["PlusCaptcha_feedback_quemejoraria"]));
  $website = json_encode(tags(empty($_POST['website'])) ? "http://{".tags($_SERVER['SERVER_NAME'])."}/" : tags($_POST['website']));
  $email = json_encode(tags($_POST['email']));
  if (tags(isset($_POST['language']))) {
    $language = (int) tags($_POST['language']);
  if (tags(isset($_POST['category']))) {
    $category = (int) tags($_POST['category']);
  if (tags(isset($_POST['site_category']))) {
    $site_category = (int) tags($_POST['site_category']);
  if (tags(isset($_POST['gender']))) {
    $gender = (int) tags($_POST['gender']);
  if ((!$ignore_post) && (tags(isset($_POST[$hidden_field_name]))) && (tags($_POST[$hidden_field_name]) == 'Y')) {
      $opt_val = tags(isset($_POST[$opt_name])) ? tags($_POST[$opt_name]) : null;
  $plscptf_options_submit['plscptf_user_email'] = tags($_REQUEST['plscptf_user_email']);
  $plscptf_options_submit['plscptf_custom_email'] = tags($_REQUEST['plscptf_custom_email']);
  $plscptf_options_submit['plscptf_select_email'] = tags($_REQUEST['plscptf_select_email']);
  $plscptf_options_submit['plscptf_additions_options'] = tags(isset($_REQUEST['plscptf_additions_options'])) ? tags($_REQUEST['plscptf_additions_options']) : 0;
    $plscptf_options_submit['plscptf_send_copy'] = tags(isset($_REQUEST['plscptf_send_copy'])) ? tags($_REQUEST['plscptf_send_copy']) : 0;
    $plscptf_options_submit['plscptf_mail_method'] = tags($_REQUEST['plscptf_mail_method']);
    $plscptf_options_submit['plscptf_from_field'] = tags($_REQUEST['plscptf_from_field']);
    $plscptf_options_submit['plscptf_display_add_info'] = tags(isset($_REQUEST['plscptf_display_add_info'])) ? 1 : 0;
    $plscptf_options_submit['plscptf_change_label'] = tags(isset($_REQUEST['plscptf_change_label'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_sent_from'] = tags(isset($_REQUEST['plscptf_display_sent_from'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_date_time'] = tags(isset($_REQUEST['plscptf_display_date_time'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_coming_from'] = tags(isset($_REQUEST['plscptf_display_coming_from'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_display_user_agent'] = tags(isset($_REQUEST['plscptf_display_user_agent'])) ? 1 : 0;
      $plscptf_options_submit['plscptf_name_label'] = tags(isset($_REQUEST['plscptf_name_label'])) ? tags($_REQUEST['plscptf_name_label']) : $plscptf_options_submit['plscptf_name_label'];
      $plscptf_options_submit['plscptf_email_label'] = tags(isset($_REQUEST['plscptf_email_label'])) ? tags($_REQUEST['plscptf_email_label']) : $plscptf_options_submit['plscptf_email_label'];
      $plscptf_options_submit['plscptf_subject_label'] = tags(isset($_REQUEST['plscptf_subject_label'])) ? tags($_REQUEST['plscptf_subject_label']) : $plscptf_options_submit['plscptf_subject_label'];
      $plscptf_options_submit['plscptf_message_label'] = tags(isset($_REQUEST['plscptf_message_label'])) ? tags($_REQUEST['plscptf_message_label']) : $plscptf_options_submit['plscptf_message_label'];
    $plscptf_options_submit['plscptf_action_after_send'] = tags($_REQUEST['plscptf_action_after_send']);
    $plscptf_options_submit['plscptf_thank_text'] = tags($_REQUEST['plscptf_thank_text']);
    $plscptf_options_submit['plscptf_redirect_url'] = tags($_REQUEST['plscptf_redirect_url']);
    if ( tags(isset($_REQUEST['PlusCaptcha_form_contact'])) ) {
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

		'sckey'		=> ( tags( isset( $_POST[ 'sckey' ]) ) ? tags($_POST[ 'sckey' ]) : '' ),
		'scvalue'	=> ( tags( isset( $_POST[ 'scvalue' ]) ) ? tags($_POST[ 'scvalue' ]) : '' )
	if (  tags( !empty( $_POST ) ) && get_result(simpleSessionGet("contacto", "")) == false ) {
	if ( tags($_POST['stage']) == 'validate-user-signup' ) {
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}
    $page_url = ( tags(isset($_SERVER["HTTPS"])) && tags($_SERVER["HTTPS"]) == "on" ? "https://" : "http://" ) . tags($_SERVER["SERVER_NAME"]) . tags($_SERVER["REQUEST_URI"]);
    $name = tags(isset($_REQUEST['plscptf_contact_name'])) ? tags($_REQUEST['plscptf_contact_name']) : "";
    $email = tags(isset($_REQUEST['plscptf_contact_email'])) ? tags($_REQUEST['plscptf_contact_email']) : "";
    $subject = tags(isset($_REQUEST['plscptf_contact_subject'])) ? tags($_REQUEST['plscptf_contact_subject']) : "";
    $message = tags(isset($_REQUEST['plscptf_contact_message'])) ? tags($_REQUEST['plscptf_contact_message']) : "";
    $send_copy = tags(isset($_REQUEST['plscptf_contact_send_copy'])) ? tags($_REQUEST['plscptf_contact_send_copy']) : "";
    if (tags(isset($_REQUEST['plscptf_contact_action']))) {
    if ("" != tags($_REQUEST['plscptf_contact_name']))
    if ("" != tags($_REQUEST['plscptf_contact_email']) && preg_match("/^(?:[a-z0-9]+(?:[a-z0-9\-_\.]+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})$/i", tags(trim($_REQUEST['plscptf_contact_email']))))
    if ("" != tags($_REQUEST['plscptf_contact_subject']))
    if ("" != tags($_REQUEST['plscptf_contact_message']))
      $subject = tags($_REQUEST['plscptf_contact_subject']);
        $form_action_url = 'https://' . tags($_SERVER['HTTP_HOST']) . tags($_SERVER['REQUEST_URI']);
        $form_action_url = 'http://' . tags($_SERVER['HTTP_HOST']) . tags($_SERVER['REQUEST_URI']);
        $userdomain = gethostbyaddr(tags($_SERVER['REMOTE_ADDR']));
							<td>' . __('Sent from (ip address)', 'PlusCaptcha') . ':</td><td>' . tags($_SERVER['REMOTE_ADDR']) . " ( " . $userdomain . " )" . '</td>
							<td>' . __('Using (user agent)', 'PlusCaptcha') . ':</td><td>' . plscptf_clean_input(tags($_SERVER['HTTP_USER_AGENT'])) . '</td>
						<td width="160">' . __("Name", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_name']) . '</td>
						<td>' . __("Email", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_email']) . '</td>
						<td>' . __("Subject", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_subject']) . '</td>
						<td>' . __("Message", 'PlusCaptcha') . '</td><td>' . tags($_REQUEST['plscptf_contact_message']) . '</td>
        $headers .= 'From: ' . tags($_REQUEST['plscptf_contact_email']) . "\r\n";
        if (tags(isset($_REQUEST['plscptf_contact_send_copy'])) && tags($_REQUEST['plscptf_contact_send_copy']) == 1)
          wp_mail(tags($_REQUEST['plscptf_contact_email']), stripslashes($subject), stripslashes($message), $headers, $attachments);
        $headers .= 'From: ' . tags($_REQUEST['plscptf_contact_email']) . "\r\n";
        if (tags(isset($_REQUEST['plscptf_contact_send_copy'])) && tags($_REQUEST['plscptf_contact_send_copy']) == 1)
          @mail(tags($_REQUEST['plscptf_contact_email']), stripslashes($subject), stripslashes($message), $headers);
Version: 2.0.14
= 2.0.10 =
* Cross-site scripting (XSS) loged user side fixed. Thanks to Carlo Pelliccioni @ Hacktive Security

= 2.0.10 =
* Cross-site scripting (XSS) loged user side fixed. Thanks to Carlo Pelliccioni @ Hacktive Security

<?php
if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

		.'quemejorar='.substr(str_replace(".","[dot]",urlencode(tags($_POST["PlusCaptcha_feedback_quemejoraria"]))),0,299).
<?php

if (!function_exists('tags')) {
	# Clean
	# Limpiar data
	function tags($tags){  
		$tags = strip_tags($tags);  
		$tags = stripslashes($tags);  
		$tags = htmlentities($tags);
		$tags = addslashes($tags);
		return trim($tags);  
	}
}

?>