oss-security - Wordpress Pinboard theme XSS

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH_aqbvKO3v1jKdk4idWTmDyAJKY5p3NYYSZvNN9wPyWMw3MJg@mail.gmail.com>
Date: Sat, 9 Feb 2013 11:47:18 -0200
From: Henrique Montenegro <typoon@...il.com>
To: oss-security@...ts.openwall.com
Subject: Wordpress Pinboard theme XSS

Hello!

I am writing to notify you about a XSS I have found in the free Pinboard
1.0.6 theme for Wordpress. This XSS happens in one of the administration
pages so it can only be triggered by authenticated users.

Here is the part of the code that is compromised
(includes/theme-options.php):

<?php $tab = ( isset( $_GET['tab'] ) ? $_GET['tab'] : 'general' ); ?>
    <input name="pinboard_theme_options[submit-<?php echo $tab; ?>]"
type="submit" class="button-primary" value="<?php _e( 'Save Settings',
'pinboard' ); ?>" />
    <input name="pinboard_theme_options[reset-<?php echo $tab; ?>]"
type="submit" class="button-secondary" value="<?php _e( 'Reset Defaults',
'pinboard' ); ?>" />

The issue happens because the variable $_GET['tab'] is not being properly
escaped, causing the issue.

Here is a proof of concept:

http://wordpress_site_with_active_pinboard_theme/wp-admin/themes.php?page=pinboard_options&tab=
]"><script>alert(document.cookie)</script>

For accessing the URL directly, Firefox should be used as Chrome seems to
have some anti-XSS protections in place.

Could a CVE please be assigned to this?

Regards,

Henrique

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.