XSS – Nextgen gallery 0.96 wordpress plugin

Bom, esse post e dedicado a esse XSS que encontrei no modoulo nextgen do wordpress, sua amplitude nao e tao grande devido a ser um XSS dentro do modulo de admin, porem so reforca que a checagem de todas as entradas e extremamente necessaria!

==============================

XSS – Nextgen gallery 0.96 wordpress plugin

==============================

Author: Eduardo Neves a.k.a _eth0_
Date: 07 june 2008
Site: webappsecurity.wordpress.com

—————————————

APPLICATION : Nextgen gallery 
VERSION : <= 0.96
VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/
DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/

—————————————

IMPACT: XSS, XSRF, etc….

—————————————

Description:

This vulnerability can be explored writing in the descritption textbox a mailicous (or not) code

link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed

In the description textbox write the text:

<script>alert(‘xss’);</script>

And when the gallery was posted, user click in photo and the script was executed!

Some pictures: