WordPress Comment Rating Plugin Cross Site Request Forgery Vulnerability
BID:45225
Info
WordPress Comment Rating Plugin Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 45225 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 07 2010 12:00AM |
| Updated: | Dec 07 2010 12:00AM |
| Credit: | krebsonsecurity |
| Vulnerable: |
WordPress Comment Rating 2.9.20 |
| Not Vulnerable: |
WordPress Comment Rating 2.9.21 |
Discussion
WordPress Comment Rating Plugin Cross Site Request Forgery Vulnerability
The Comment Rating plugin for WordPress is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.
Versions prior to Comment Rating 2.9.21 are vulnerable.
The Comment Rating plugin for WordPress is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.
Versions prior to Comment Rating 2.9.21 are vulnerable.
Exploit / POC
WordPress Comment Rating Plugin Cross Site Request Forgery Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.
To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.
Solution / Fix
WordPress Comment Rating Plugin Cross Site Request Forgery Vulnerability
Solution:
Updates are available. Please see the reference for more details.
Solution:
Updates are available. Please see the reference for more details.
References
WordPress Comment Rating Plugin Cross Site Request Forgery Vulnerability
References:
References:
- Comment Rating Change log (WordPress)
- Comment Rating Homepage (WordPress)