PT-2010-5478 · WordPress · Register Plus

Publicado 2010-12-04 · Atualizado 2018-10-10 · CVE-2010-4402

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Register Plus plugin versions 3.5.1 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in a register action, including firstname, lastname, website, aim, yahoo, jabber, about, pass1, and pass2. This can occur in the wp-login.php file.

Recommendations For Register Plus plugin versions 3.5.1 and earlier, update to a version later than 3.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the register action in wp-login.php to minimize the risk of exploitation. Avoid using the vulnerable parameters in the register action until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-4402

Produtos afetados

Register Plus

Referências · 8

• 🔥 http://packetstormsecurity.org/files/view/96143/registerplus-xss.txt · Exploit
• 🔥 http://websecurity.com.ua/4539 · Exploit
• http://osvdb.org/69491 · Nota
• http://secunia.com/advisories/42360 · Aviso do Fabricante
• http://securityfocus.com/archive/1/514903/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4402 · Nota de Segurança
• http://securityfocus.com/bid/45057 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4402 · Nota