|
|
| |
WordPress is "a state-of-the-art semantic personal publishing platform with a focus on aesthetics, web standards, and usability".
The WordPress product has been found to contain multiple cross site scripting vulnerabilities. |
| |
Credit:
The information has been provided by Thomas Waldegger.
|
| |
Vulnerable Systems:
* WordPress version 1.2.1 and prior
Immune Systems:
* WordPress version 1.2.2
wp-login.php CSS:
The following code can be seen inside the wp-login.php file:
> // If someone has moved WordPress let's try to detect it
> if ( dirname('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']) != get_settings('siteurl') )
> update_option('siteurl', dirname('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']) );
With an URI like
/wp-login.php?=">< script>alert(document.cookie)</script></script>
An attacker is able to store arbitrary values in the global siteurl setting.
An additional parameter of wp-login.php that is vulnerable is 'redirect_to'.
Multiple /wp-admin/ CSS:
The following files and their corresponding parameters are vulnerable to a cross site scripting vulnerabilities:
/wp-admin/bookmarklet.php?popupurl=[XSS]
/wp-admin/bookmarklet.php?content=[XSS]
/wp-admin/edit-comments.php?s=[XSS]
/wp-admin/edit-comments.php?s=bla&submit=Search&mode=[XSS]
/wp-admin/templates.php?file=[XSS]
/wp-admin/link-add.php?linkurl=[XSS]
/wp-admin/link-add.php?name=[XSS]
/wp-admin/link-categories.php?cat_id=[XSS]&action=Edit
/wp-admin/link-manager.php?order_by=[XSS]
/wp-admin/link-manager.php?cat_id=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_url=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_name=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_description=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_rel=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_image=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_rss_uri=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_notes=[XSS]
/wp-admin/link-manager.php?action=linkedit&link_id=[XSS]
/wp-admin/link-manager.php?action=linkedit&order_by=[XSS]
/wp-admin/link-manager.php?action=linkedit&cat_id=[XSS]
/wp-admin/post.php?content=[XSS]
/wp-admin/moderation.php?action=update&item_approved=[XSS]
Solution:
Upgrade to WordPress version 1.2.2.
|
|
|
