< and > are not filtered in upload.php

• 

  burncycle23 · Member · May 21, 2018 at 11:57 am

  • Copy link
  • Add topic to favorites

  Hello together,

  i found something strange in the upload.php file of wordpress (newest version).

  if i make the following request if im logged in:

  http://yourwordpressinstall.tld/wp-admin/upload.php?message=<somehtmltag&gt;

  it wont filterd out or not encoded in the queryvars javascript variable…

  i hope nobody can exploit this … i just want to inform you…

  have a nice day!

  Greetings
  burncycle

• 

  ravichahar · Member · May 21, 2018 at 12:05 pm

  • Copy link

  Hey burncycle23,

  You sound to use the self-hosted WordPress version(.org). Please share the link to your website.

  It’s important to notice that WordPress.com and WordPress.org and two different platforms. To know more, please read this.

  WordPress.com vs. WordPress.org

• 

  burncycle23 · Member · May 21, 2018 at 12:08 pm

  • Copy link

  here the link:

  https://blog.beran-solutions.de/

  ;)

• 

  ravichahar · Member · May 21, 2018 at 12:16 pm

  • Copy link

  As I mentioned above, You use the self-hosted WordPress version(.org).

  We’re only able to help with the websites hosted on WordPress.com.

  Please either contact your web hosting customer support or submit your query to WordPress.org forums.
  https://wordpress.org/support/forums/

  To do so, you need to create an account on WordPress.org.
  https://login.wordpress.org/register

• 

  burncycle23 · Member · May 21, 2018 at 12:22 pm

  • Copy link

  hi,

  okay – i see buts in all installations of wordpress!

  Greetings
  burncycle

• 

  burncycle23 · Member · May 21, 2018 at 12:23 pm

  • Copy link

  i think so cause the code is the same as self hosted or not!

  greetz
  burncycle

• 

  ravichahar · Member · May 21, 2018 at 12:39 pm

  • Copy link

  WordPress is an open source software which is used on both the platforms. But when you have a self-hosted (WordPress.org) website, you use any web hosting company, not WordPress.com.

  Whereas WordPress.com is a fully-hosted platform which takes of everything and no user has an access to the core files or any type of code of the website.

  As you have mentioned the upload.php file, it means you have access to the WordPress files from your web hosting cPanel.

  Please read the difference for more clarification.

  WordPress.com vs. WordPress.org

• 

  burncycle23 · Member · May 21, 2018 at 12:52 pm

  • Copy link

  okay – once again:

  i wont access this file through the file system its over the normal webbrowser – for example this:

  https://blog.beran-solutions.de/wp-login.php?redirect_to=https%3A%2F%2Fblog.beran-solutions.de%2Fwp-admin%2Fupload.php%3Fmessage%3D%253Cscript%253E&reauth=1

  now i login and then the thing is done :/

  – i hope you understand ;)

  Greetz
  burncycle

• 

  burncycle23 · Member · May 21, 2018 at 1:04 pm

  • Copy link

  ok i think i know what you mean – but you should fix this anyway ;)

  greetz
  burncycle