Search Unleashed 0.2.10 JavaScript injection (Wordpress plugin)
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Search Unleashed 0.2.10 JavaScript injection (Wordpress plugin)
- From: "Krzysztof Burghardt" <krzysztof@xxxxxxxxxxxx>
- Date: Wed, 13 Feb 2008 21:33:29 +0100
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition:x-google-sender-auth; bh=VtGZi+nVfkYJ4Zj6R1DA5HI4/sHFDUD6+pRFeJOTE8Y=; b=vCxPmv1OUsMrY0Z/YEQOx7sOsalACnbuyLHtgdEKYHIevHRbVwMvIHj0RDihz5N7qsCHcLkL73Qxoo32YQO6aHrA9+QcH6AI4pWAU6yKbs5QKs3RzDc5ovl/Ii+CDKv8HwHKVuZDB01uISc+ah9c0tceMFqMJOipsHYEDlaSWWw=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:sender:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition:x-google-sender-auth; b=hX+bWhlkA6nYyzXbvBB4Pv7MMXBBI5KFd++1X5niugjqZLkuwdeKBP1pK6svj89/kUY70RXaLlKkwOaCnZ8vCkHprZ2L2Ujxl/A3acZXdLedxrY9vcBCsdJbeeGi+olzw78+eSlYN3snAZ1Fl/f0BbyifWJl4r/tT40cafhnkQU=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
- Sender: krzysztof.burghardt@xxxxxxxxx
Hello all,
There is a bug in "Log" function of Search Unleashed by John Godley,
version 0.2.10.
This plug-in stores search queries but does not validates stored data
and put them back "raw" to browser.
HTML and Java Script can be injected with search request:
/blog/?s=%3Ctextarea+onmouseover%3D%22alert%28document.cookie%29%3B%22%3E%3C%2Ftextarea%3E&searchbutton=go%21
To execute injected code admin have to go to Manage -> Search
Unleashed -> Log (and in my example point his cursor to text area).
Author was notified by his bug tracker:
http://urbangiraffe.com/tracker/issues/show/60
Regards,
--
Krzysztof Burghardt <krzysztof@xxxxxxxxxxxx>
http://www.burghardt.pl/