WordPress detects second critical vulnerability
A cross-site scripting (XSS) vulnerability was recently released for the latest version of WordPress 4.2 (it also works in all older versions) and can be exploited by a malicious user to run arbitrary code on the server.
An attacker exploiting the flaw could take control of the target website by creating new administrator accounts. In addition to the current version of WordPress 4.2, versions 4.1.2, 4.1.1, and 3.9.3 are also affected.
The vulnerability was discovered by Jouko Pynnönen of research firm Kli kki Oy in Finland, and is similar to one that was patched in Word Press 4.1.2, after it was disclosed to the software developers by researcher Cedric Van Bockhaven about 14 months ago, on February 23, 2014.
Pynnönen's method targets WordPress comments and the way a large text message (larger than 64 KB) is truncated, and the comment is stored in the website's database.
Comments larger than 64 KB are truncated via My SQL. Truncation of messages leads to HTML code errors on the page, and can be exploited by an attacker to add attributes to supported HTML tags and submit malicious JavaScript code.
Pynnönen used the vulnerability to launch an exploit on the targeted website when the administrator tried to approve the comment. The researcher tested the vulnerability on My SQL versions 1.5.53 and 5.5.41.
Until the patch is released by WordPress, administrators of websites running WordPress are advised not to approve any comments.
Source: iguru.gr
