CVE-2013-10030: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to information disclosure. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230672.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2023-06-05T22:15Z
Repository: https://github.com/wp-plugins/wordpress-exit-box-lite
Language: PHP
Files changed: wordpress-exit-box-lite.php
Commit date: 2013-05-28 17:47:25 +0000
Commit message: added security checks to avoid full path disclosure, XSS, unprivileged manipulation 

git-svn-id: https://plugins.svn.wordpress.org/wordpress-exit-box-lite/trunk@719474 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/wordpress-exit-box-lite.php b/wordpress-exit-box-lite.php
index 27219ac..a2557ff 100644
--- a/wordpress-exit-box-lite.php
+++ b/wordpress-exit-box-lite.php
@@ -1,22 +1,25 @@
 <?php
 
 /**
  * @package Wordpress Exit Box Lite
  * @author Bouzid Nazim Zitouni
- * @version 1.06
+ * @version 1.10
  */
 /*
 Plugin Name: Wordpress Exit Box Lite
 Plugin URI: http://angrybyte.com/wordpress-plugins/wordpress-exit-box-finally-released/
 Description: Wordpress exit box is used design and display your exit box, a ThickBox page that will be shown to your users when they click a external link.
 Author: Bouzid Nazim Zitouni
-Version: 1.06
+Version: 1.10
 Author URI: http://angrybyte.com
 */
 
-
+if(!function_exists('add_action')){
+    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
+    die;
+}
 add_option("exitboxcontents",
     '<h2 style="text-align: center;">It was nice having you! We hope you enjoyed your stay.</h2>',
     'Contents of the Exit page', 'yes');
 add_option("exitboxdelay", '15', 'yes');
 add_option("boxautoredirect", '0', 'yes');
@@ -86,12 +89,11 @@ function exitboxadmin()
     add_options_page('Wordpress Exit Box Lite', 'Wordpress Exit Box Lite', 8,
         __file__, 'exit_box_admin');
 }
 function exit_box_admin()
 {
-
-    if ($_POST['xx'])
+     if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_box_save', 'exit_box_nonce' ))
     {
 
         if (is_numeric($_POST['exitboxwidth']) || $_POST['exitboxwidth'] == "auto")
             update_option('exitboxwidth', $_POST['exitboxwidth']);
         if (is_numeric($_POST['exitboxheight']) || $_POST['exitboxheight'] == "auto")
@@ -127,11 +129,11 @@ EOFT;
 
     } else
     {
         echo "<textarea name='xx' cols='150' rows='20'>$oldtemp</textarea>";
     }
-
+    wp_nonce_field( 'exit_box_save','exit_box_nonce' ); 
     echo <<< EOFT
 
   <br/>
   <br/>
   <table><tbody>

Vulnerable code:  * @version 1.06
Version: 1.06


    if ($_POST['xx'])

Fixed code:  * @version 1.10
Version: 1.10
if(!function_exists('add_action')){
    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
    die;
}
     if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_box_save', 'exit_box_nonce' ))
    wp_nonce_field( 'exit_box_save','exit_box_nonce' );