lists.openwall.net   lists  /  announce  john-users  owl-users  popa3d-users  /  xvendor  oss-security  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4 
Open Source and information security mailing list archives
 
This website is powered by Openwall GNU/*/Linux security-enhanced OS
[<prev] [next>] [month] [year] [list] 
Date: Sat, 7 Jun 2008 23:07:36 -0300
From: "Eduardo Jorge" <serrano.neves@...il.com>
To: bugtraq@...urityfocus.com
Subject: XSS - NEXTGEN GALLERY 0.96 WORDPRESS PLUGIN

==============================

XSS - Nextgen gallery 0.96 wordpress plugin

==============================

Author: Eduardo Neves a.k.a _eth0_
Date: 07 june 2008
Site: webappsecurity.wordpress.com

.............

APPLICATION : Nextgen gallery
VERSION : <= 0.96
VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/
DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/

.............

IMPACT: XSS, XSRF, etc..

.............

Descrition:

This vulnerability can be explored writing in the descritption textbox
a mailicous (or not) code

link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed

In the description textbox write the text:

<script>alert('xss');</script>

And when the gallery was posted, user click in photo and the script
was executed!

-- 
|_|0|_| Serrano Neves - a.k.a eth0
|_|_|0| http://webappsecurity.wordpress.com
|0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux