Search Unleashed 0.2.10 JavaScript injection (Wordpress plugin)

2008.02.20

Credit: Krzysztof Burghardt

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2008-0837

CWE: CWE-79

Ogólna skala CVSS: 4.3/10

Znaczenie: 2.9/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Brak

Wpływ na integralność: Częściowy

Wpływ na dostępność: Brak

Hello all,

There is a bug in "Log" function of Search Unleashed by John Godley,
version 0.2.10.

This plug-in stores search queries but does not validates stored data
and put them back "raw" to browser.

HTML and Java Script can be injected with search request:
/blog/?s=%3Ctextarea+onmouseover%3D%22alert%28document.cookie%29%3B%22%3
E%3C%2Ftextarea%3E&searchbutton=go%21

To execute injected code admin have to go to Manage -> Search
Unleashed -> Log (and in my example point his cursor to text area).

Author was notified by his bug tracker:
http://urbangiraffe.com/tracker/issues/show/60

Regards,
-- 
Krzysztof Burghardt <krzysztof (at) burghardt (dot) pl [email concealed]>
http://www.burghardt.pl/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Search Unleashed 0.2.10 JavaScript injection (Wordpress plugin)

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.