added 17 characters in body
Source Link
fealXX
  • 297
  • 2
  • 11

I do believe I just found it: The Yuzo Related Posts Plugin does not check for authentication when saving options.

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for authentication, but that is a "false friend" and only checks if the accessed page is in the admin-area, not if a user is authenticated (nor authorized). See the Wordpress documentation.

A quick solution to keep using the plugin is just removing the settings option by putting false in the if-Statement in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Update:

Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now.

I do believe I just found it: The Yuzo Related Posts Plugin does not check for authentication when saving options.

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for authentication, but that is a "false friend" and only checks if the accessed page is in the admin-area, not if a user is authenticated. See the Wordpress documentation.

A quick solution to keep using the plugin is just removing the settings option by putting false in the if-Statement in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Update:

Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now.

I do believe I just found it: The Yuzo Related Posts Plugin does not check for authentication when saving options.

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for authentication, but that is a "false friend" and only checks if the accessed page is in the admin-area, not if a user is authenticated (nor authorized). See the Wordpress documentation.

A quick solution to keep using the plugin is just removing the settings option by putting false in the if-Statement in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Update:

Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now.

rereformated
Source Link
fealXX
  • 297
  • 2
  • 11

I do believe I just found it: The Yuzo Related Posts Plugin does not check for autnenticationauthentication when saving options.

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for authentication, but that is a "false friend" and only checks if the accessed page is in the admin-area, not if a user is authenticationauthenticated. See See the Wordpress documentation.

A quick solution to keep using the plugin is just removing the settings option by putting false in the if-Statement in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Update:

Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now.

I do believe I just found it: The Yuzo Related Posts Plugin does not check for autnentication when saving options.

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for authentication, but that is a "false friend" and only checks if the accessed page is in the admin-area, not if a user is authentication. See the Wordpress documentation.

A quick solution to keep using the plugin is just removing the settings option by putting false in the if in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Update:

Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now.

I do believe I just found it: The Yuzo Related Posts Plugin does not check for authentication when saving options.

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for authentication, but that is a "false friend" and only checks if the accessed page is in the admin-area, not if a user is authenticated. See the Wordpress documentation.

A quick solution to keep using the plugin is just removing the settings option by putting false in the if-Statement in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Update:

Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now.

I do believe I just found it: The Yuzo Related Posts Plugin does not check for authautnentication when saving options. So

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>console.logstyle><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post/wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin()is_admin() to check for authauthentication, whilebut that is a false friend"false friend" and only checks if the accessed page is in the admin-area, not for authif a user is authentication. See the https://codex.wordpress.org/Function_Reference/is_adminWordpress documentation.

A quick Solutionsolution to keep Usingusing the plugin is just removing the Settingssettings option by putting false in the if in /assets/functions/options.php/assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }
    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Will update if I find a better fix.Update:

edit: HangHang Guan pointed to a Blog Post about this issue from last weeka Blog Post about this issue from last week, seems like it is "out in the wild" now: https://www.pluginvulnerabilities.com/2019/03/30/wordpress-plugin-team-paints-target-on-exploitable-settings-change-vulnerability-that-permits-persistent-xss-in-related-posts/.

I do believe I just found it: The Plugin does not check for auth when saving options. So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>console.log('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for auth, while that is a false friend and checks if the accessed page is in the admin-area, not for auth. https://codex.wordpress.org/Function_Reference/is_admin

A quick Solution to keep Using the plugin is just removing the Settings option by putting false in the if in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Will update if I find a better fix.

edit: Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now: https://www.pluginvulnerabilities.com/2019/03/30/wordpress-plugin-team-paints-target-on-exploitable-settings-change-vulnerability-that-permits-persistent-xss-in-related-posts/

I do believe I just found it: The Yuzo Related Posts Plugin does not check for autnentication when saving options.

So POSTing

yuzo_related_post_css_and_style=</style><script+language=javascript>alert('hacked');</script> 

to /wp-admin/options-general.php?page=yuzo-related-post will succeed, even if you're not logged in.

The Plugin is using is_admin() to check for authentication, but that is a "false friend" and only checks if the accessed page is in the admin-area, not if a user is authentication. See the Wordpress documentation.

A quick solution to keep using the plugin is just removing the settings option by putting false in the if in /assets/functions/options.php line 1155:

    function __construct(){

        global $if_utils;

        $this->utils = $if_utils;

        if(false/* is_admin() */)
            self::configuration_plugin();
        else
            self::parameters();

    }

Update:

Hang Guan pointed to a Blog Post about this issue from last week, seems like it is "out in the wild" now.

added 294 characters in body
Source Link
fealXX
  • 297
  • 2
  • 11
Loading
Source Link
fealXX
  • 297
  • 2
  • 11
Loading