PT-2008-2661 · WordPress · Sniplets Plugin For Wordpress

Nbbn · Publicado 2008-02-28 · Atualizado 2018-10-11 · CVE-2008-1061

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sniplets plugin for WordPress versions 1.1.2 and 1.2.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the text parameter to endpoints such as "warning.php", "notice.php", and "inset.php" in the "view/sniplets/" directory, and possibly "modules/execute.php". Additionally, the url parameter to "view/admin/submenu.php" and the page parameter to "view/admin/pager.php" are vulnerable.

Recommendations For Sniplets plugin for WordPress version 1.1.2, update to a version that fixes the XSS vulnerabilities. For Sniplets plugin for WordPress version 1.2.2, update to a version that fixes the XSS vulnerabilities. As a temporary workaround, consider restricting access to the vulnerable endpoints, such as "warning.php", "notice.php", "inset.php", "modules/execute.php", "view/admin/submenu.php", and "view/admin/pager.php", until a patch is available. Avoid using the text, url, and page parameters in the affected endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1061

Produtos afetados

Sniplets Plugin For Wordpress

Referências · 8

• 🔥 https://exploit-db.com/exploits/5194 · Exploit
• 🔥 http://securityfocus.com/bid/27985 · Exploit
• http://securityfocus.com/archive/1/488734/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1061 · Nota de Segurança
• http://securityreason.com/securityalert/3706 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40830 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1061 · Nota
• http://secunia.com/advisories/29099 · Aviso do Fabricante