BugTraq
Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin Aug 08 2016 03:53PM
Summer of Pwnage (lists securify nl)
------------------------------------------------------------------------

Cross-Site Request Forgery vulnerability in Add From Server WordPress
Plugin
------------------------------------------------------------------------

Edwin Molenaar, July 2016

------------------------------------------------------------------------

Abstract
------------------------------------------------------------------------

It was discovered that Add From Server is vulnerabile to Cross-Site
Request Forgery. It can be exploited by luring the target user into
clicking a specially crafted link or visiting a malicious website (or
advertisement). An attacker can use this issue to add illegal content to
the victims server, or add very large files to the victim's server to
exaust the amount of avalible disk space.

------------------------------------------------------------------------

OVE ID
------------------------------------------------------------------------

OVE-20160718-0004

------------------------------------------------------------------------

Tested versions
------------------------------------------------------------------------

These issues were successfully tested on Add From Server WordPress
Plugin version 6.2.

------------------------------------------------------------------------

Fix
------------------------------------------------------------------------

This issue is resolved in Add From Server version 3.3.2.

------------------------------------------------------------------------

Details
------------------------------------------------------------------------

https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_vulnerabili
ty_in_add_from_server_wordpress_plugin.html

------------------------------------------------------------------------

Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus