BugTraq
Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin Aug 15 2016 04:20PM
Summer of Pwnage (lists securify nl)
------------------------------------------------------------------------

Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login
Redirect WordPress Plugin
------------------------------------------------------------------------

Yorick Koster, July 2016

------------------------------------------------------------------------

Abstract
------------------------------------------------------------------------

A Cross-Site Scripting vulnerability was found in the Peter's Login
Redirect WordPress Plugin. This issue allows an attacker to perform a
wide variety of actions, such as stealing Administrators' session
tokens, or performing arbitrary actions on their behalf. In addition the
Plugin is vulnerable to Cross-Site Request Forgery, which allows an
attacker to change any setting of this plugin. In order to exploit this
issue, the attacker has to lure/force a logged on WordPress
Administrator into opening a malicious website.

------------------------------------------------------------------------

OVE ID
------------------------------------------------------------------------

OVE-20160724-0028

------------------------------------------------------------------------

Tested versions
------------------------------------------------------------------------

This issue was successfully tested on Peter's Login Redirect WordPress
Plugin version 2.9.0.

------------------------------------------------------------------------

Fix
------------------------------------------------------------------------

This issue is resolved in Peter's Login Redirect version 2.9.1.

------------------------------------------------------------------------

Details
------------------------------------------------------------------------

https://sumofpwn.nl/advisory/2016/cross_site_scripting_cross_site_reques
t_forgery_in_peter_s_login_redirect_wordpress_plugin.html

------------------------------------------------------------------------

Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus