« Spam Protection For My Daily Thoughts - My Daily Thought On Early Warning For Agloco Member »

WordPress Cross-Site Scripting Vulnerability

27 March 2007
Author: Mind Posted under News

wordpress-logo.png

Since this Blog is powered by Wordpress, the news from Secunia is increasing my awareness about this Blog’s security. It says:

WordPress “PHP_SELF” Cross-Site Scripting Vulnerability

Description:
A vulnerability has been discovered in WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the “PHP_SELF” variable is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

The vulnerability is confirmed in version 2.1.2. Other versions may also be affected.

Solution:
Reportedly fixed in versions 2.0.10-RC2 and 2.1.3-RC2.

Provided and/or discovered by:
Independently discovered by Alexander Concha and Jungsonn.

Changelog:
2007-03-27: Added CVE reference.

Original Advisory:
http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt

Fortunately this vulnerability is not critical and the solution is available. I will wait until stable version of 2.1.3 released and upgrading this Blog after that. Meanwhile I will be more careful with my browser’s cookies and always logout after I finish working on this Blog.

Posted On ,

Share This

Related Posts

Random Posts

U COMMENT
I FOLLOW

2 Responses to ' WordPress Cross-Site Scripting Vulnerability '

Subscribe to comments with RSS or TrackBack to ' WordPress Cross-Site Scripting Vulnerability '.

  1. cosa said,

    on April 1st, 2007 at 1:49 am

    ic, one of my blog (using WP 2.1) got hacked last week. The hacker changed the admin password and several blog’s options, as well as removed all of my posts.

    And I thought WP 2.1 already secure enough…

    PS: Buddy, I’ve moved my blog back to US server :) Feel free to visit it again :)

    Thanks for your information… I’ll be there soon…Admin

  2. WordPress upgrade to 213 | My Daily Thoughts said,

    on April 3rd, 2007 at 10:32 am

    […] I become more confidence with this Blog security, after my previous post which reveal vulnerability on WordPress 2.1.2. However it is always be better to play save with […]

Leave a reply