Full Disclosure mailing list archives
Cross-Site Scripting in Atahualpa WordPress Theme
From: Summer of Pwnage <lists () securify nl>
Date: Wed, 1 Mar 2017 07:08:41 +0100
------------------------------------------------------------------------ Cross-Site Scripting in Atahualpa WordPress Theme ------------------------------------------------------------------------ Spyros Gasteratos, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ A number of Cross-Site Scripting vulnerabilities were found in the Atahualpa WordPress Theme. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators' session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to use the CSRF vulnerability described in SFY20160759 to trick the admin into storing malicious input. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0004 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on Atahualpa WordPress Theme WordPress Theme. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ There is currently no fix available. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_atahualpa_wordpress_theme.html ------------------------------------------------------------------------ Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Cross-Site Scripting in Atahualpa WordPress Theme Summer of Pwnage (Feb 28)