Vulnerable Systems:
* WordPress version 1.2.1 and prior
Immune Systems:
* WordPress version 1.2.2
wp-login.php CSS:
The following code can be seen inside the wp-login.php file: > // If someone has moved WordPress let's try to detect it
> if ( dirname('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']) != get_settings('siteurl') )
> update_option('siteurl', dirname('http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']) );
With an URI like /wp-login.php?=">< script>alert(document.cookie)</script></script>
An attacker is able to store arbitrary values in the global siteurl setting.
An additional parameter of wp-login.php that is vulnerable is 'redirect_to'.
Multiple /wp-admin/ CSS:
The following files and their corresponding parameters are vulnerable to a cross site scripting vulnerabilities:
