full-disclosure - Re: IL and XSS vulnerabilities in multiple themes for WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 7 Jun 2011 18:57:44 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: "David Sopas" <davidsopas@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: IL and XSS vulnerabilities in multiple themes
	for WordPress

Hi David!

You need to look harder ;-). Looks like you checked these two themes on those sites, admins of which deleted this file. There are admins who can understand that scripts with phpinfo must not be at working sites (but it's rare cases, and larger part of the sites with affected themes for WP contain test.php).

Yes, I've check all these 15 themes (I've tested even more and wasted a lot of time on it, but found exactly at these 15 themes). I've found them at live web sites in Internet, as I mentioned earlier.

Here are examples of the sites with test.php in Typebased and NewsPress themes:

http://thenetexperiment.com/wp-content/themes/typebased/includes/test.php

http://coporan.3x.ro/wp-content/themes/newspress/includes/test.php

For example, in April I was trying to find test.php in these 15 and other themes at WooThemes' demo site, but they haven't this file in any of their themes (among those tested by me). So as for their own sites, then they understand the risk, and when to sell holes for large price for their clients, then they already don't understand the risk and position it as a feature :-).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
  ----- Original Message ----- 
  From: David Sopas 
  To: MustLive 
  Cc: full-disclosure@...ts.grok.org.uk 
  Sent: Tuesday, June 07, 2011 12:43 AM
  Subject: Re: [Full-disclosure] IL and XSS vulnerabilities in multiple themes for WordPress

  Just checked on two of those themes you wrote (Typebased and NewsPress) and they don't have any test.php file.
  Did you check them all? 

  On 4 June 2011 17:17, MustLive <mustlive@...security.com.ua> wrote:

    Hello list!

    I want to warn you about Information Leakage and Cross-Site Scripting
    vulnerabilities in multiple themes for WordPress.

    -------------------------
    Affected products:
    -------------------------

    Vulnerable are the next themes by WooThemes: Live Wire (all three themes
    from Live Wire series), Gotham News, Typebased, Blogtheme, VibrantCMS, Fresh
    News, The Gazette Edition, NewsPress, The Station, The Original Premium
    News, Flash News, Busy Bee, Geometric. Other vulnerable themes for WP are
    possible.

    ----------
    Details:
    ----------

    In different themes there is test.php - script with phpinfo() - which leads
    to Information Leakage (disclosure of FPD and other important information
    about the server) and XSS (in PHP < 4.4.1, 4.4.3-4.4.6).

    Information Leakage (WASC-13):

    http://site/wp-content/themes/_theme's_name_/includes/test.php

    XSS (WASC-08):

    http://site/wp-content/themes/_theme's_name_/includes/test.php?a[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E

    For Live Wire the script is placed at address
    http://site/wp-content/themes/livewire/includes/test.php, similarly for
    other themes.

    ------------
    Timeline:
    ------------

    2011.04.11 - announced at my site.
    2011.04.12 - informed developers.
    2011.06.04 - disclosed at my site.

    These vulnerabilities are still not fixed by developers. So users of these
    themes are need to fix the vulnerabilities manually (e.g. by deleting of
    this script).

    I mentioned about these vulnerabilities at my site
    (http://websecurity.com.ua/5071/).

    Best wishes & regards,
    MustLive
    Administrator of Websecurity web site
    http://websecurity.com.ua

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/