Product: eShop for Wordpress Vendor: Rich Pedley ( http://wordpress.org/extend/plugins/eshop/ ) Vulnerable Version: 6.2.8 and probably prior Tested on: 6.2.8 Vendor Notification: 20 July 2011 Vulnerability Type: XSS (Cross Site Scripting) Status: Fixed by Vendor Risk level: Medium Credit: High-Tech Bridge SA Security Research Lab ( http://HdhCmsTesthtbridge.ch/advisory/ \ )
Vulnerability Details: High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in \ eShop for Wordpress, which can be exploited to perform cross-site scripting attacks \ against logged-in Wordpress Administrator.
1) Input passed via the "eshoptemplate" GET parameter to /wp-admin/admin.php (when \ "page" is set to "eshop-templates.php") is not properly sanitised before being \ returned to the user. This can be exploited to execute arbitrary HTML and script code \ in a administrator's browser session in context of affected website.
The following PoC code is available:
http://[HdhCmsTest2cto测试数据]/wp-admin/admin.php?page=eshop-templates.php&eshoptemplate=%22%3E%3Cscrip \ t%3Ealert%28document.cookie%29;%3C/script%3E
2) Input passed via the "action" GET parameter to /wp-admin/admin.php (when "page" is \ set to "eshop-orders.php") is not properly sanitised before being returned to the \ user. This can be exploited to execute arbitrary HTML and script code in a \ administrator's browser session in context of affected website.
The following PoC code is available:
http://[HdhCmsTest2cto测试数据]/wp-admin/admin.php?page=eshop-orders.php&view=1&action=%22%3E%3Cscript%3 \ Ealert%28document.cookie%29;%3C/script%3E
3) Input passed via the "viewemail" GET parameter to /wp-admin/admin.php (when "page" \ is set to "eshop-orders.php") is not properly sanitised before being returned to the \ user. This can be exploited to execute arbitrary HTML and script code in a \ administrator's browser session in context of affected website.
http://[HdhCmsTest2cto测试数据]/wp-admin/admin.php?page=eshop-orders.php&viewemail=%22%3E%3Cscript%3Eale \ rt%28document.cookie%29;%3C/script%3E Solution: Upgrade to the most recent version
查看更多关于Wordpress网店插件eShop多重xss - 网站安全 - 自学ph的详细内容...