AMC Registration in 23 days
Mon December 15, 2008

Suffolk County Math Tournament in 48 days
Fri January 9, 2009

PUMaC in 70 days
Sat January 31, 2009

AMC 12A in 80 days
Tue February 10, 2009

HMMT in 91 days
Sat February 21, 2009

World Math Day in 102 days
Wed March 4, 2009

AIME I in 128 days
Mon March 30, 2009

PLUS! magazine deadline in 129 days
Tue March 31, 2009

USAMO in 157 days
Tue April 28, 2009

ARML in 188 days
Fri May 29, 2009

21st Birthday in 659 days
Sun September 12, 2010

Turning 40 in 7599 days
Wed September 12, 2029

tags in Topics

more tags

Feeds

Navigation

Links

If you liked this post, buy me a beer... I mean cookie.

Wordpress 2.12 XSS Fix

Posted March 22nd, 2007 by Mgccl

in

If you are using wordpress 2.12, you could get some XSS in your site
http://www.yourdomain.com/?year=xss%3C/title%3E%3Cbody%20onmousemove=document.write(document.cookie);%3E%3C/body%3E
Thx for Simon show me the code :hot:
The original post for this XSS are here from ChX Security

If it works, please what is shown below to temporarily fix it before Wordpress release a new version.
1.Find wp-includes/general-template.php
2.Find wp_title function
3. Find this

if(!empty($year)){
$title = $year;
}

4. Change into this

if(!empty($year)){
$year = (int)$year;
$title = $year;
}

Now the $year will be converted to an integer. No more XSS problem.

Bookmark/Search this post with:

[...] parecer esta nueva

On Mar/28/2007 14:50:49 » Blog Archive » Bug XSS en Wordpress 2.1.2 (not verified) says:

[...] parecer esta nueva actualización de wordpress ya esta dando sus primeros bugs, en este caso El problema radica en el tratamiento del parametro que indica el año a la hora de filtrar y compromete directamente la función wp_title() mediante XSS. Este xss nos da [...]

reply

[...] El problema radica en

On Mar/27/2007 07:12:53 aNieto2K | Parche XSS para Wordpress 2.1.12 (not verified) says:

[...] El problema radica en el tratamiento del parametro que indica el año a la hora de filtrar y compromete directamente la función wp_title() mediante XSS. [...]