medium6.8Public exploit code
CVE-2007-1244
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as admin…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Core 2.1.1 - 'post.php' Cross-Site Scripting2007-02-26 · webapps · php · Verified
Impact
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | through 2.1.1 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0583.html
- http://osvdb.org/33787
- http://osvdb.org/33788
- http://secunia.com/advisories/24566
- http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml
- http://www.securityfocus.com/archive/1/461351/100/0/threaded
- http://www.securityfocus.com/bid/22735
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32703
- http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0583.html
- http://osvdb.org/33787
- http://osvdb.org/33788
- http://secunia.com/advisories/24566
- http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml
- http://www.securityfocus.com/archive/1/461351/100/0/threaded
- http://www.securityfocus.com/bid/22735
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32703