Wordpress Index.PHP Cross-Site Scripting Vulnerability
BID:21318
Info
Wordpress Index.PHP Cross-Site Scripting Vulnerability
| Bugtraq ID: | 21318 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 28 2006 12:00AM |
| Updated: | Nov 29 2006 08:49PM |
| Credit: | rMrGvG is credited with the discovery of this vulnerability. |
| Vulnerable: |
WordPress WordPress 1.5 |
| Not Vulnerable: |
WordPress WordPress 1.5.1 |
Discussion
Wordpress Index.PHP Cross-Site Scripting Vulnerability
Wordpress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Wordpress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
Wordpress Index.PHP Cross-Site Scripting Vulnerability
No exploit is required.
The following proof-of-concept URI is available:
http://www.example.com/wp-admin/edit.php?s=[XSS]&submit=Search
No exploit is required.
The following proof-of-concept URI is available:
http://www.example.com/wp-admin/edit.php?s=[XSS]&submit=Search
Solution / Fix
Wordpress Index.PHP Cross-Site Scripting Vulnerability
Solution:
The vendor has addressed this issue in Wordpress version 2.0.6; please see the reference section for details.
Solution:
The vendor has addressed this issue in Wordpress version 2.0.6; please see the reference section for details.