XSS - NEXTGEN GALLERY 0.96 WORDPRESS PLUGIN

2008.06.10
Credit: Eduardo Jorge
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

============================== XSS - Nextgen gallery 0.96 wordpress plugin ============================== Author: Eduardo Neves a.k.a _eth0_ Date: 07 june 2008 Site: webappsecurity.wordpress.com &#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533; APPLICATION : Nextgen gallery VERSION : <= 0.96 VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/ DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/ &#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533; IMPACT: XSS, XSRF, etc&#65533;. &#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533; Descrition: This vulnerability can be explored writing in the descritption textbox a mailicous (or not) code link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed In the description textbox write the text: <script>alert('xss');</script> And when the gallery was posted, user click in photo and the script was executed! <pre>-- |_|0|_| Serrano Neves - a.k.a eth0|_|_|0| http://webappsecurity.wordpress.com|0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds</pre>

References:

http://seclists.org/bugtraq/2008/Jun/0070.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top