WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities
BID:61140
Info
WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 61140 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-4954 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2013 12:00AM |
| Updated: | Jul 31 2013 10:46AM |
| Credit: | gravitylover |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities
Pie Register plugin for WordPress is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Pie Register 1.30 is vulnerable; other versions may also be affected.
Pie Register plugin for WordPress is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Pie Register 1.30 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities
To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.
Following example data is available:
<?php echo $_POST['pass1'];?>
<?php echo $_POST['pass2'];?>
To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.
Following example data is available:
<?php echo $_POST['pass1'];?>
<?php echo $_POST['pass2'];?>
Solution / Fix
WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
WordPress Pie Register Plugin 'wp-login.php' Multiple Cross Site Scripting Vulnerabilities
References:
References:
- WordPress Homepage (WordPress)