CVE-2015-3634: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2017-06-08T21:29Z
Repository: https://github.com/Boonstra/Slideshow
Language: PHP
Files changed: classes/SlideshowPluginSlideshowStylesheet.php, readme.txt
Commit date: 2015-04-23 16:20:41 +0200
Commit message: Fixed security vulnerability with custom stylesheets

Diff: diff --git a/classes/SlideshowPluginSlideshowStylesheet.php b/classes/SlideshowPluginSlideshowStylesheet.php
index 9fd6a9e..e5f17fd 100644
--- a/classes/SlideshowPluginSlideshowStylesheet.php
+++ b/classes/SlideshowPluginSlideshowStylesheet.php
@@ -185,14 +185,20 @@ class SlideshowPluginSlideshowStylesheet
 	 * @param string $styleName
 	 * @return string $stylesheet
 	 */
 	public static function getStylesheet($styleName)
 	{
-		// Get custom stylesheet, of the default stylesheet if the custom stylesheet does not exist
-		$stylesheet = get_option($styleName, '');
+		// Get custom style keys
+		$customStyleKeys = array_keys(get_option(SlideshowPluginGeneralSettings::$customStyles, array()));
 
-		if (strlen($stylesheet) <= 0)
+		// Match $styleName against custom style keys
+		if (in_array($styleName, $customStyleKeys))
+		{
+			// Get custom stylesheet
+			$stylesheet = get_option($styleName, '');
+		}
+		else
 		{
 			$stylesheetFile = SlideshowPluginMain::getPluginPath() . DIRECTORY_SEPARATOR . 'style' . DIRECTORY_SEPARATOR . 'SlideshowPlugin' . DIRECTORY_SEPARATOR . $styleName . '.css';
 
 			if (!file_exists($stylesheetFile))
 			{
@@ -200,11 +206,11 @@ class SlideshowPluginSlideshowStylesheet
 			}
 
 			// Get contents of stylesheet
 			ob_start();
 			include($stylesheetFile);
-			$stylesheet .= ob_get_clean();
+			$stylesheet = ob_get_clean();
 		}
 
 		// Replace the URL placeholders with actual URLs and add a unique identifier to separate stylesheets
 		$stylesheet = str_replace('%plugin-url%', SlideshowPluginMain::getPluginUrl(), $stylesheet);
 		$stylesheet = str_replace('%site-url%', get_bloginfo('url'), $stylesheet);
diff --git a/readme.txt b/readme.txt
index f72cbad..37c2878 100644
--- a/readme.txt
+++ b/readme.txt
@@ -180,12 +180,13 @@ personal taste.
 
 
 == Changelog ==
 
 = 2.2.22 =
-*   Compatible with WordPress 4.0.
+*   Compatible with WordPress 4.2.
 *	Default stylesheets are no longer dynamically loaded through admin-ajax.php.
+*	Fixed: Security vulnerability in the SlideshowPluginSlideshowStylesheet class.
 *	Fixed: An issue with admin-ajax.php when the frontend uses HTTP, while the backend uses HTTPS. Thanks to [Chris Scott](https://github.com/chrisscott)
 *	Fixed: A bug that caused the previous slide button and the navigation bullets to malfunction on "Cross Fade" setting.
 *   Fixed: Slideshow container calculation now uses the JavaScript round function instead of the floor function.
 *   Added Norwegian translation by A. Nonymous.
 *   Updated Persian translation by W3Design.

Vulnerable code: 		// Get custom stylesheet, of the default stylesheet if the custom stylesheet does not exist
		$stylesheet = get_option($styleName, '');
		if (strlen($stylesheet) <= 0)
			$stylesheet .= ob_get_clean();
*   Compatible with WordPress 4.0.
Fixed code: 		// Get custom style keys
		$customStyleKeys = array_keys(get_option(SlideshowPluginGeneralSettings::$customStyles, array()));
		// Match $styleName against custom style keys
		if (in_array($styleName, $customStyleKeys))
		{
			// Get custom stylesheet
			$stylesheet = get_option($styleName, '');
		}
		else
			$stylesheet = ob_get_clean();
*   Compatible with WordPress 4.2.
*	Fixed: Security vulnerability in the SlideshowPluginSlideshowStylesheet class.