PT-2008-2661 · WordPress · Sniplets Plugin For Wordpress

Nbbn · Published 2008-02-28 · Updated 2018-10-11 · CVE-2008-1061

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sniplets plugin for WordPress versions 1.1.2 and 1.2.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the text parameter to endpoints such as "warning.php", "notice.php", and "inset.php" in the "view/sniplets/" directory, and possibly "modules/execute.php". Additionally, the url parameter to "view/admin/submenu.php" and the page parameter to "view/admin/pager.php" are vulnerable.

Recommendations For Sniplets plugin for WordPress version 1.1.2, update to a version that fixes the XSS vulnerabilities. For Sniplets plugin for WordPress version 1.2.2, update to a version that fixes the XSS vulnerabilities. As a temporary workaround, consider restricting access to the vulnerable endpoints, such as "warning.php", "notice.php", "inset.php", "modules/execute.php", "view/admin/submenu.php", and "view/admin/pager.php", until a patch is available. Avoid using the text, url, and page parameters in the affected endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-1061

Affected Products

Sniplets Plugin For Wordpress

References · 8

• 🔥 https://exploit-db.com/exploits/5194 · Exploit
• 🔥 http://securityfocus.com/bid/27985 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1061 · Security Note
• http://secunia.com/advisories/29099 · Vendor Advisory
• http://securityfocus.com/archive/1/488734/100/0/threaded · Note
• http://securityreason.com/securityalert/3706 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40830 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1061 · Note