Home > websecurity > XSS – Nextgen gallery 0.96 wordpress plugin

XSS – Nextgen gallery 0.96 wordpress plugin

Bom, esse post e dedicado a esse XSS que encontrei no modoulo nextgen do wordpress, sua amplitude nao e tao grande devido a ser um XSS dentro do modulo de admin, porem so reforca que a checagem de todas as entradas e extremamente necessaria! ūüôā


XSS – Nextgen gallery 0.96 wordpress plugin


Author: Eduardo Neves a.k.a _eth0_
Date: 07 june 2008
Site: webappsecurity.wordpress.com


APPLICATION : Nextgen gallery 
VERSION : <= 0.96
VENDOR : http://wordpress.org/extend/plugins/nextgen-gallery/
DOWNLOAD : http://wordpress.org/extend/plugins/nextgen-gallery/





This vulnerability can be explored writing in the descritption textbox a mailicous (or not) code

link: http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery&mode=edit&gid=[galleryID]&_wpnonce=0b3c0996ed

In the description textbox write the text:


And when the gallery was posted, user click in photo and the script was executed!

Some pictures:



Categories: websecurity
  1. Alex Rabe
    June 8, 2008 at 7:16 am

    Are you able to access to the page without admin access ? I’m not able to enter this code , when I have no access to the admin section

  2. webappsecurity
    June 8, 2008 at 1:02 pm

    This code is inserte in inserted in admin page, to “explore” it is necessary a admin privilege!

  3. Alex Rabe
    June 8, 2008 at 2:06 pm

    Ok, you can insert the same code into a post/page. Is this also a XSS ? It was my intention to allow in description field html code, I don’t see any issue as long no evil person have access to your blog, or I’m wrong ?

  4. webappsecurity
    June 8, 2008 at 2:16 pm

    A possibility to execute scripts is not a best pratice to code, this error have a lowest impact, because this only can be reproduced by a site adminsitrator. If your intention is html code, use an escape to not allow script execution in IMHO.

  5. Alex Rabe
    June 8, 2008 at 2:37 pm

    Ok,thanks to point this out. I will consider a update in the next release

  6. June 8, 2008 at 4:08 pm

    This flaw we could use CSRF and send some malicious URL to the wordpress admin and hijacking the cookie session. Not an easy stuff but it’s possible .

    Good job eth0 =)


  7. eti
    June 10, 2008 at 9:18 am

    This is still bad if you allow users to add/edit images in the gallery.

  8. November 10, 2008 at 6:36 pm

    Thanks for writing this.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: