CVE-2011-10006: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in GamerZ WP-PostRatings up to 1.64. It has been classified as problematic. This affects an unknown part of the file wp-postratings.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.65 is able to address this issue. The identifier of the patch is 6182a5682b12369ced0becd3b505439ce2eb8132. It is recommended to upgrade the affected component. The identifier VDB-259629 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-04-08T13:15Z
Repository: https://github.com/wp-plugins/wp-postratings
Language: PHP
Files changed: postratings-admin-ajax.php, postratings-admin-css.css, postratings-admin-js.dev.js, postratings-css-rtl.css, postratings-css.css, postratings-js.dev.js, postratings-manager.php, postratings-options.php, postratings-stats.php, postratings-templates.php, postratings-uninstall.php, wp-postratings.php
Commit date: 2011-02-17 09:03:00 +0000
Commit message: Fixed XSS + Increment version number

git-svn-id: https://plugins.svn.wordpress.org/wp-postratings/trunk@346735 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/postratings-admin-ajax.php b/postratings-admin-ajax.php
index 92a89b1..2bd365d 100644
--- a/postratings-admin-ajax.php
+++ b/postratings-admin-ajax.php
@@ -1,10 +1,10 @@
 <?php
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-admin-css.css b/postratings-admin-css.css
index f0f13fa..c297ff2 100644
--- a/postratings-admin-css.css
+++ b/postratings-admin-css.css
@@ -1,9 +1,9 @@
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-admin-js.dev.js b/postratings-admin-js.dev.js
index 86e44be..144585a 100644
--- a/postratings-admin-js.dev.js
+++ b/postratings-admin-js.dev.js
@@ -1,9 +1,9 @@
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-css-rtl.css b/postratings-css-rtl.css
index 8679b6f..b205b6f 100644
--- a/postratings-css-rtl.css
+++ b/postratings-css-rtl.css
@@ -1,9 +1,9 @@
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-css.css b/postratings-css.css
index 407299f..0f6d33b 100644
--- a/postratings-css.css
+++ b/postratings-css.css
@@ -1,9 +1,9 @@
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-js.dev.js b/postratings-js.dev.js
index 525acba..61ea044 100644
--- a/postratings-js.dev.js
+++ b/postratings-js.dev.js
@@ -1,9 +1,9 @@
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-manager.php b/postratings-manager.php
index e6fba4a..1e27f85 100644
--- a/postratings-manager.php
+++ b/postratings-manager.php
@@ -1,10 +1,10 @@
 <?php
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-options.php b/postratings-options.php
index a3de8f2..1454216 100644
--- a/postratings-options.php
+++ b/postratings-options.php
@@ -1,10 +1,10 @@
 <?php
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-stats.php b/postratings-stats.php
index a72643c..6b8627e 100644
--- a/postratings-stats.php
+++ b/postratings-stats.php
@@ -1,10 +1,10 @@
 <?php
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-templates.php b/postratings-templates.php
index 7d898cc..8722927 100644
--- a/postratings-templates.php
+++ b/postratings-templates.php
@@ -1,10 +1,10 @@
 <?php
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/postratings-uninstall.php b/postratings-uninstall.php
index 8ea5d6a..2814201 100644
--- a/postratings-uninstall.php
+++ b/postratings-uninstall.php
@@ -1,10 +1,10 @@
 <?php
 /*
 +----------------------------------------------------------------+
 |																							|
-|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
+|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
 |	Copyright (c) 2009 Lester "GaMerZ" Chan									|
 |																							|
 |	File Written By:																	|
 |	- Lester "GaMerZ" Chan															|
 |	- http://lesterchan.net															|
diff --git a/wp-postratings.php b/wp-postratings.php
index 90f461c..eba50b1 100644
--- a/wp-postratings.php
+++ b/wp-postratings.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: WP-PostRatings
 Plugin URI: http://lesterchan.net/portfolio/programming/php/
 Description: Adds an AJAX rating system for your WordPress blog's post/page.
-Version: 1.60
+Version: 1.61
 Author: Lester 'GaMerZ' Chan
 Author URI: http://lesterchan.net
 */
 
 
@@ -737,12 +737,11 @@ if(strpos(get_option('stats_url'), $_SERVER['REQUEST_URI']) || strpos($_SERVER['
 	add_filter('wp_stats_page_admin_plugins', 'postratings_page_admin_general_stats');
 	add_filter('wp_stats_page_admin_most', 'postratings_page_admin_most_stats');
 	add_filter('wp_stats_page_plugins', 'postratings_page_general_stats');
 	add_filter('wp_stats_page_most', 'postratings_page_most_stats');
 }
-if ($_SERVER['PHP_SELF'] == @links_add_base_url("/", $_SERVER['HTTP_REFERER'])) 
-        return;
+
 
 ### Function: Add WP-PostRatings General Stats To WP-Stats Page Options
 function postratings_page_admin_general_stats($content) {
 	$stats_display = get_option('stats_display');
 	if($stats_display['ratings'] == 1) {

Vulnerable code: |	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.60								|
Version: 1.60
if ($_SERVER['PHP_SELF'] == @links_add_base_url("/", $_SERVER['HTTP_REFERER'])) 
        return;
Fixed code: |	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
|	WordPress 2.8 Plugin: WP-PostRatings 1.61								|
Version: 1.61