|
==============================
XSS - Nextgen gallery 0.96 wordpress plugin
==============================
Author: Eduardo Neves a.k.a _eth0_
Date: 07 june 2008
Site: webappsecurity.wordpress.com
—————————————
APPLICATION : Nextgen gallery
VERSION : <= 0.96
VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/
DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/
—————————————
IMPACT: XSS, XSRF, etc….
—————————————
Descrition:
This vulnerability can be explored writing in the descritption textbox
a mailicous (or not) code
link:
http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-
gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed
In the description textbox write the text:
<script>alert('xss');</script>
And when the gallery was posted, user click in photo and the script
was executed!
--
|_|0|_| Serrano Neves - a.k.a eth0
|_|_|0| http://webappsecurity.wordpress.com
|0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds
|
