0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
WordPress YouTube Embed 3.3.2 Cross Site Scripting Vulnerability
Author
Risk
[Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
Details
================
Software: YouTube Embed
Version: 3.3.2
Homepage: https://wordpress.org/plugins/youtube-embed/
CVE ID: CVE-2015-6535 (Pending)
CWE ID: CWE-79
CVSS: 5.5 (Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N)
Description
================
A stored XSS vulnerability in YouTube Embed 3.3.2 (and possibly earlier versions) allows admin users to compromise other admins and super admins.
YouTube Embed is a WordPress plugin with over 30,000 active installs.
Vulnerability
================
Admins on multisite installs can inject arbitrary JavaScript into pages visible to super admins via the plugin's unsanitized profile name field.
Note: Admins on multisite installs lack the unfiltered_html capability – only super admins can enter unfiltered html [2].
>From youtube-embed/includes/options-profiles.php:
31: $options[ 'name' ] = $_POST[ 'youtube_embed_name' ];
…
95: echo '<div class="updated fade"><p><strong>' . __( $options[ 'name' ].' Profile Saved.' ) . "</strong></p></div>\n";
Proof of concept
================
1. As an admin user authorized for plugins, go to the YouTube Embed Profiles page.
2. Choose a profile from the drop down list on the right and click 'Change profile'.
3. Enter an XSS payload (e.g. <script>alert(1)</script>) into the 'Profile name' field.
4. Log out and log in as a super admin or a different admin.
5. Navigate to the YouTube Embed Options page.
This has been tested with Firefox 38.2.0 on Debian.
Mitigation
================
Upgrade the plugin to version 3.3.3 or later.
Timeline
================
2015-08-19: Discovered
2015-08-19: Requested vulnerability reporting instructions via vendor support form
2015-08-20: Vendor asked that vulnerability be reported on the vendor's website plugin page
2015-08-20: Reported to vendor via plugin page
2015-08-20: Requested CVE number
2015-08-23: Vendor released version 3.3.3 – confirmed fixed
2015-08-26: Public Disclosure
References
================
[1] https://wordpress.org/plugins/youtube-embed/changelog/
[2] https://codex.wordpress.org/Roles_and_Capabilities#Additional_Admin_Capabilities
# 0day.today [2024-11-15] #