WordPress.org

Make WordPress Core

Opened 8 years ago

Closed 8 years ago

#4012 closed defect (bug) (fixed)

XSS on page-new.php

Reported by: xknown Owned by:
Milestone: 2.0.10 Priority: highest omg bbq
Severity: normal Version: 2.1.2
Component: Security Keywords: 2nd-opinion dev-feedback
Focuses: Cc:

Description

Someone posted on sla.cker.org forums a new XSS vulnerability that affects all versions, including the trunk.

Attachments (1)

link-template.diff (305 bytes) - added by xknown 8 years ago.
Cast to int page id

Download all attachments as: .zip

Change History (8)

@xknown8 years ago

Cast to int page id

comment:1 @xknown8 years ago

The given PoC is:
http://wp/wp-admin/page-new.php?saved="><script>alert(123)</script>

PS. The patch is only for the trunk

comment:2 @ryan8 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [5078]) Cast to int. Props xknown. fixes #4012 for trunk.

comment:3 @ryan8 years ago

(In [5079]) Cast to int. Props xknown. fixes #4012 for 2.1

comment:4 @charleshooper8 years ago

  • Cc charleshooper added
  • Keywords 2nd-opinion dev-feedback added
  • Resolution fixed deleted
  • Status changed from closed to reopened

Not to step on any toes as I understand this is a high priority item, however is casting to int adequate? I'm referring to the fact that wp_posts.ID is a BIGINT-sized column and the maximum size integer on 32-bit systems is 2,147,483,647. Not that I think many people out there have over 2 billion posts, but I feel that if we impose a limit (by casting a variable to int) then we should update the schema accordingly. Think of it as a SQL optimization if you must.

comment:5 @charleshooper8 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

I just took a look at the schema and also noticed that other tables create their relative post_ID fields as INT(11), I'll close this again and open another ticket as they are separate issues.

comment:6 @ryan8 years ago

  • Milestone changed from 2.1.3 to 2.0.10
  • Resolution fixed deleted
  • Status changed from closed to reopened

Reopening for 2.0 inclusion.

comment:7 @ryan8 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

(In [5080]) Cast to int. Props xknown. fixes #4012 for 2.0

Note: See TracTickets for help on using tickets.