diff --git a/cve/Exit Strategy/CVE-2013-10025/CVE-2013-10025.php b/cve/Exit Strategy/CVE-2013-10025/CVE-2013-10025.php new file mode 100644 index 0000000000000000000000000000000000000000..d0ee8f033d803f9afee8e7a10f774719fa3ff7b4 --- /dev/null +++ b/cve/Exit Strategy/CVE-2013-10025/CVE-2013-10025.php @@ -0,0 +1,42 @@ +@@ -3,18 +3,21 @@ +/** + * @package Wordpress Exit Strategy + * @author Bouzid Nazim Zitouni + * @version 1.55 + * @version 1.59 + */ +/* +Plugin Name: Wordpress Exit Strategy +Plugin URI: http://angrybyte.com/wordpress-plugins/wordpress-exit-strategy/ +Description: Exit Strategy will pass all outgoing links from your site through a nofollow link to an exit page before finally being redirected to the external link. You may place anything in your exit page: Ads, Subscribtion buttons, etc. Using Wordpress Exit Strategy you improve your SEO score by not linking directly to external pages, you get more subscribers & more revenues if you use Ads. +Author: Bouzid Nazim Zitouni +Version: 1.55 +Version: 1.59 +Author URI: http://angrybyte.com +*/ + + +if(!function_exists('add_action')){ + echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure. + die; +} +add_option("exitpagecontents", + 'Thank you for your visit, You`ll be redirected in %n% seconds
Click here if you are not redirected automatically', + 'Contents of the Exit page', 'yes'); +@@ -35,7 +38,7 @@ function exitpageadmin() +function exit_page_admin() +{ + + if ($_POST['xx']) + if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_strategy_save', 'exit_strategy_nonce' )) + { + update_option('exitpagecontents', $_POST['xx']); + update_option('redirecttoparent', $_POST['redirectpar']); +@@ -83,7 +86,7 @@ function exit_page_admin() + { + echo ""; + } + + wp_nonce_field( 'exit_strategy_save','exit_strategy_nonce' ); + echo <<< EOFT +
diff --git a/cve/Exit Strategy/CVE-2013-10025/READ ME.md b/cve/Exit Strategy/CVE-2013-10025/READ ME.md new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/cve/Exit Strategy/yaml/CVE-2013-10025.yaml b/cve/Exit Strategy/yaml/CVE-2013-10025.yaml new file mode 100644 index 0000000000000000000000000000000000000000..6206c59fdaaeb894a6b24b845417bf9c3a19ca3d --- /dev/null +++ b/cve/Exit Strategy/yaml/CVE-2013-10025.yaml @@ -0,0 +1,21 @@ +id: CVE-2013-10025 +source: https://github.com/wp-plugins/exit-strategy/commit/d964b8e961b2634158719f3328f16eda16ce93ac +info: + name: Exit Strategy Plugin 1.55 + severity: medium + description: | + 在Exit Strategy Plugin 1.55中发现一个漏洞,并将其归类为有问题。受此问题影响的是文件exitpage.php中的函数exitpageadmin。该操作会导致跨站请求伪造。该攻击可能是远程发起的。升级到1.59版本能够解决这个问题。 + scope-of-influence: + Docker 20.10.15, build fd82621 + reference: + - https://github.com/wp-plugins/exit-strategy/commit/d964b8e961b2634158719f3328f16eda16ce93ac + - https://vuldb.com/?ctiid.225266 + - https://vuldb.com/?id.225266 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N + cvss-score: 4.3 + cve-id: CVE-2013-10025 + cwe-id: CWE-352 + cnvd-id: None + kve-id: None + tags: Exit Strategy \ No newline at end of file diff --git a/other_list.yaml b/other_list.yaml index ede901d9b464ce9df31a8ad0e18854fec49bfc0d..1a41f3fc67fcc2beb257e2754ad6d2c49dea9d3c 100644 --- a/other_list.yaml +++ b/other_list.yaml @@ -58,5 +58,7 @@ cve: - CVE-2022-30525 WordPress: - CVE-2019-8942 + Exit Strategy: + - CVE-2013-10025 cnvd: