[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <511C848D.6060206@redhat.com>
Date: Wed, 13 Feb 2013 23:30:37 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Henrique Montenegro <typoon@...il.com>
Subject: Re: Wordpress Pinboard theme XSS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/13/2013 03:03 AM, Kurt Seifried wrote:
> On 02/09/2013 06:47 AM, Henrique Montenegro wrote:
>> Hello!
>
>> I am writing to notify you about a XSS I have found in the free
>> Pinboard 1.0.6 theme for Wordpress. This XSS happens in one of
>> the administration pages so it can only be triggered by
>> authenticated users.
>
>> Here is the part of the code that is compromised
>> (includes/theme-options.php):
>
>> <?php $tab = ( isset( $_GET['tab'] ) ? $_GET['tab'] : 'general'
>> ); ?> <input name="pinboard_theme_options[submit-<?php echo
>> $tab; ?>]" type="submit" class="button-primary" value="<?php _e(
>> 'Save Settings', 'pinboard' ); ?>" /> <input
>> name="pinboard_theme_options[reset-<?php echo $tab; ?>]"
>> type="submit" class="button-secondary" value="<?php _e( 'Reset
>> Defaults', 'pinboard' ); ?>" />
>
>> The issue happens because the variable $_GET['tab'] is not being
>> properly escaped, causing the issue.
>
>> Here is a proof of concept:
>
>> http://wordpress_site_with_active_pinboard_theme/wp-admin/themes.php?page=pinboard_options&tab=
>
>>
>
> ]"><script>alert(document.cookie)</script>
>
>> For accessing the URL directly, Firefox should be used as Chrome
>> seems to have some anti-XSS protections in place.
>
>> Could a CVE please be assigned to this?
>
>> Regards,
>
>> Henrique
>
> Can you please post the download links/have you notified upstream?
> THanks.
He replied offlist.
Please use CVE-2013-0286 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRHISNAAoJEBYNRVNeJnmTdGwP/2HY1EXDcaRGAM8qbWspiN4X
d37xZhc51LoIChigL4qv9jUajIVln6XVDuitl2J8dx38k6WsZjmj2DuRMgtAh06u
lQ1/THswm18R8lMvExCaXs9BQw2qZ9oj8OTBebOv9OxD+4EOvATjhuoFPYhSYAZ+
rn3sKqY0mWRU/TuvHiB2IFepCyfvoH7Ca9BYW185HILIKHebe44ZGVNR20499nCp
wgAnuZCzurp3n2/weoW0HMsyyZdi/koiuUrgv6qJ3/UPNDn7wj0IjBHm8FQTKSPO
c0ah/OQVXOBgLJaBuM9gmrD31Au9OyByBnYbkBeIjxNhnfmQci0M+c/x9VVwxx+U
ec8b1tMaq7WLwJQ1pRLNmuoQ69KR9R/1k6T7iu1o2x1Z9EA2hb3vW7N/vY2zSiyp
BbQj+e40XfoC0knPxQOl9k7alC5ZOAumzxbnEwnFfXu79aYWYCw83SqVB8NXj0fo
xFQQGYFlkUh52XiWEQFDOVg8p1Y8Z+V/nOvpOzX8+flgjr19eHjH5/wpelNyUe0B
vI6r2ZTB0fwBSrWfP1b+nnoLJpNTbK6/gTRqEdUlNWJ/oRQp2iNAEdVH64nYmK/o
nO/UD6AFUgdzERcVTX7ECpcqcGMJxUSp8nyoHVu+OOOP7N2umW5nDbBQ6TDxX/4y
8W4iocXsfxZ/BvQ8PfaB
=6BmL
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
