Exploit discovered in WordPress Template.php

ADVERTISEMENTS

A Cross-site scripting (XSS) vulnerability has been discovered in wp-admin/templates.php in WordPress which allows remote attackers to inject arbitrary web script or HTML via the file parameter.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

All versions of WordPress are affected. WordPress has fixed this for v2.0.6 and released a patch for v2.0.5. To patch, simply overwrite the original file after taking backup.

When I heard about this exploit the first time, I refused to believe it as I found no info about this on WordPress. But, when Ashish forwarded me the reply he got from Matt, I decided to patch my templates.php.

It’s a minor prob that was already public and that we already patched, it’ll be included in the upcoming 2.0.6 release.

You can read more about this exploit on Security Focus and Operation n.

Search JohnTP.com or view a random post

Related Articles

• WordPress 2.0.2 security release
• WordPress 2.1.1 is Dangerous, Upgrade Now!
• Using your Sites Traffic to get laid?
• How to increase your AdSense Revenue by 200%
• I [heart] WordPress Logo competition

To receive this blogs articles for FREE on your email inbox, just enter your email address below and click 'Go':

Enter your email address: or get updates via RSS.

Find out what I am doing currently by following me on Twitter.

Posted on January 3rd, 2007 | Category: Threats, WordPress | 10 Comments »

10 responses so far,

1. 1

   Dj Flush

   January 4, 2007 at 5:37 am

   Ahh never mind about the Exploit John

   but Guys do check out my recently started blog at Sizlopedia.com

   I have added special Reference to John TP

2. 2

   Fanatyk

   January 4, 2007 at 8:29 pm

   huh.
   Do You know anything about latest version in download?
   I hava an archive downloaded on 01.01.07 and this line looks like this:

   echo “<li><a href=’templates.php?file=” . wp_specialchars($recent, true) . “‘>” . get_file_description(basename($recent)) . “</a></li>”;

   Do I need to make changes anyway?

3. 3

   listikal

   January 5, 2007 at 7:27 pm

   I’ll have to take the time to upgrade my version to 2.0.6 at some point. Thanks for the tip John.

4. 4

   Utah SEO Planet

   January 5, 2007 at 10:08 pm

   Thanks for the announcement. I’m upgrading all my blogs now.

5. 5

   Grigor

   January 5, 2007 at 11:58 pm

   Hello John,
   Thanks for the tip. I’ll do the patch as well.

6. 6

   Bong

   January 6, 2007 at 2:39 pm

   It’s high time I upgrade. But the thought of upgrade dreads me as I have edited many of the WP files…

7. 7

   muratcan

   January 12, 2007 at 6:13 am

   I’ll have to take the time to upgrade my version to some point. Thanks for the tip John.

8. 8

   sohbet

   January 12, 2007 at 6:17 am

   Thanks for the announcement. I’m upgrading all my blogs now.

9. 9

   sourcer

   January 12, 2007 at 2:17 pm

   Thanks for tips

10. 10

    nikita

    January 15, 2007 at 11:55 am

    great tips, you always give your reader the best resources