Title: Reflected XSS in wordpress plugin amtythumb v4.1.2 |
Author: Larry W. Cashdollar, @_larry0 |
Date: 2016-02-09 |
Download Site: https://wordpress.org/plugins/amtythumb |
Downloads: 2876 |
Vendor Notified: 2016-02-09 |
Export: Json |
Vendor Contact: plugins@wordpress.org |
Plugin Name: amtythumb |
Vulnerability: There is a reflected XSS vulnerability in the following php code ./amtythumb/amtyThumbAdminPg.php:
112: Post ID : <input type="text" name="pid" value="<?php echo $_POST['pid'];?>"/>
129: Image URL/Post ID : <input type="text" name="post_id" value="<?php echo $_POST['post_id'];?>" style="width:250px"/>
133: Percent (only numeric) : <input type="text" name="percent" value="<?php echo $_POST['percent'];?>" style="width:50px"/> |
134: Width : <input type="text" name="width" value="<?php echo $_POST['width'];?>" style="width:50px"/>
135: Height : <input type="text" name="height" value="<?php echo $_POST['height'];?>" style="width:50px"/>
The variable pid appears to send unsanitized data back to the users browser via POST request.
|
CVE-ID: Not Released |
File:./amtythumb/amtyThumbAdminPg.php |
Exploit Code: Exploit was derived from appearance of first vulnerable parameter in code, there could be more shown above.
|