1. Этот сайт использует файлы cookie. Продолжая пользоваться данным сайтом, Вы соглашаетесь на использование нами Ваших файлов cookie. Узнать больше.
Приветствуем вас,Гость, на форуме IFUD.WS. Обязательно рекомендуется к прочтению правила форума http://ifud.ws/threads/obnovleno-pravila-foruma.7759

WordPress 4.2 stored XSS

Тема в разделе "Веб-Уязвимости | Эксплуатация", создана пользователем Favertes, 28 апр 2015.

  1. TopicStarter Overlay


    14 апр 2015
    From: Jouko Pynnonen <jouko () iki fi>Date: Mon, 27 Apr 2015 05:15:46 +0300
    Current versions of WordPress are vulnerable to a stored XSS. An
    unauthenticated attacker can inject JavaScript in WordPress comments.
    The script is triggered when the comment is viewed.
    If triggered by a logged-in administrator, under default settings the
    attacker can leverage the vulnerability to execute arbitrary code on
    the server via the plugin and theme editors.
    Alternatively the attacker could change the administrator’s password,
    create new administrator accounts, or do whatever else the currently
    logged-in administrator can do on the target system.
    If the comment text is long enough, it will be truncated when inserted
    in the database. The MySQL TEXT type size limit is 64 kilobytes so the
    comment has to be quite long.
    The truncation results in malformed HTML generated on the page. The
    attacker can supply any attributes in the allowed HTML tags, in the
    same way as with the two other recently published stored XSS
    vulnerabilities affecting the WordPress core.
    The vulnerability bears a similarity to the one reported by Cedric Van
    Bockhaven in 2014 (patched this week, after 14 months). Instead of
    using an invalid UTF-8 character to truncate the comment, this time an
    excessively long comment text is used for the same effect.
    In these two cases the injected JavaScript apparently can't be
    triggered in the administrative Dashboard, so these exploits require
    getting around comment moderation e.g. by posting one harmless comment
    Enter the following as a comment:
    <a title='x onmouseover=alert(unescape(/hello%20world/.source))
    AAAAAAAAAAAA [64 kb] ...'></a>
    This was tested on WordPress 4.2, 4.1.2, and 4.1.1, MySQL versions
    5.1.53 and 5.5.41.
    Disable comments (Dashboard, Settings/Discussion, select as
    restrictive options as possible). Do not approve any comments.
    The vulnerability was discovered by Jouko Pynnönen of Klikki Oy.
    An up-to-date version of this document: http://klikki.fi/adv/wordpress2.html
    Jouko Pynnönen <jouko () iki fi>
    Klikki Oy - http://klikki.fi - @klikkioy
    Source Please login or register to view links
    • Like Like x 2

Поделиться этой страницей