JaypeeOnline

Permalinks Migration Plugin Vulnerability

Over at Weblog Tools Collection, an article was posted earlier today regarding a vulnerability in version 1.0 of the Deans Permalinks Migration Plugin. The said vulnerability involves XSRF or Cross-site request forgery and allow the attacker to steal valid credentials from the database.The person who found out about this vulnerability and goes by the name g30rg3_x has an explanation for this vulnerability:Since the variable $dean_pm_config[’oldstructure’] its not correctly sanitized (when retrieving), this allow any user to store/save “malicious code” inside the database and later be injected this “malicious code” when the data is retrieved. Using the XSRF as a “combo” we can create crafted pages that will force users to conduct this injection and steal some valid credentials to the WordPress based CMS.