Wordpress的插件Gallery存在存储型跨站漏洞

一、详细说明：其中包括情报涉及的人员、利用点、利用方式等

存在漏洞的版本

研究员测试的是Gallery version 1.9.65

确定漏洞修复的版本

Gallery version 2.0.6

如下是研究者的全文

------------------------------------------------------------------------
Stored Cross-Site Scripting in Gallery - Image Gallery WordPress Plugin
------------------------------------------------------------------------
Sipke Mellema, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A persistent Cross-Site Scripting vulnerability was found in the Gallery
- Image Gallery plugin. This issue allows an attacker to perform a wide
variety of actions, such as stealing Administrators' session tokens, or
performing arbitrary actions on their behalf. In order to exploit this
issue, the attacker has to lure/force a logged on WordPress
Administrator into opening a URL provided by an attacker.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0015

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on the Gallery - Image Gallery
WordPress Plugin version 1.9.65.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in Gallery - Image Gallery WordPress Plugin
version 2.0.6.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_in_gallery___image_gallery_wordpress_plugin.html

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

二、问题证明：

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0015