CVE-2013-10024: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the file exitpage.php. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.59 is able to address this issue. The identifier of the patch is d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. The identifier VDB-225265 was assigned to this vulnerability.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2023-04-08T17:15Z
Repository: https://github.com/wp-plugins/exit-strategy
Language: PHP
Files changed: exitpage.php
Commit date: 2013-05-28 17:53:26 +0000
Commit message: Security improvements, preventing XSS, full path disclosure, and unprivileged manipulation.

git-svn-id: https://plugins.svn.wordpress.org/exit-strategy/trunk@719477 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/exitpage.php b/exitpage.php
index 659f9dd..b813c7c 100644
--- a/exitpage.php
+++ b/exitpage.php
@@ -1,22 +1,25 @@
 <?php
 
 /**
  * @package Wordpress Exit Strategy
  * @author Bouzid Nazim Zitouni
- * @version 1.55
+ * @version 1.59
  */
 /*
 Plugin Name: Wordpress Exit Strategy
 Plugin URI: http://angrybyte.com/wordpress-plugins/wordpress-exit-strategy/
 Description: Exit Strategy will pass all outgoing links from your site through a nofollow link to an exit page before finally being redirected to the external link. You may place anything in your exit page: Ads, Subscribtion buttons, etc. Using Wordpress Exit Strategy you improve your SEO score by not linking directly to external pages, you get more subscribers & more revenues if you use Ads.
 Author: Bouzid Nazim Zitouni
-Version: 1.55
+Version: 1.59
 Author URI: http://angrybyte.com
 */
 
-
+if(!function_exists('add_action')){
+    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
+    die;
+}
 add_option("exitpagecontents",
     'Thank you for your visit, You`ll be redirected in %n% seconds <br> <a href="%link%">Click here if you are not redirected automatically</a>',
     'Contents of the Exit page', 'yes');
 add_option("exitpagedelay", '10', 'yes');
 add_option("autoredirect", '1', 'yes');
@@ -33,11 +36,11 @@ function exitpageadmin()
         'exit_page_admin');
 }
 function exit_page_admin()
 {
 
-    if ($_POST['xx'])
+    if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_strategy_save', 'exit_strategy_nonce' ))
     {
         update_option('exitpagecontents', $_POST['xx']);
         update_option('redirecttoparent', $_POST['redirectpar']);
 
     }
@@ -81,11 +84,11 @@ EOFT;
         wp_editor($oldtemp, "xx");
     } else
     {
         echo "<textarea name='xx' cols='150' rows='20'>$oldtemp</textarea>";
     }
-
+     wp_nonce_field( 'exit_strategy_save','exit_strategy_nonce' ); 
     echo <<< EOFT
 
   <br/>
   <ul>
   <li>%n% will be replaced by the redirect delay<br /></li>

Vulnerable code:  * @version 1.55
Version: 1.55

    if ($_POST['xx'])

Fixed code:  * @version 1.59
Version: 1.59
if(!function_exists('add_action')){
    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
    die;
}
    if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_strategy_save', 'exit_strategy_nonce' ))
     wp_nonce_field( 'exit_strategy_save','exit_strategy_nonce' );