CVE-2013-10027: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-06-04T14:15Z
Repository: https://github.com/wp-plugins/blogger-importer
Language: PHP
Files changed: blogger-importer.php, readme.txt
Commit date: 2013-10-08 14:29:47 +0000
Commit message: Adding a nonce to prevent CSRF.



git-svn-id: https://plugins.svn.wordpress.org/blogger-importer/trunk@784566 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/blogger-importer.php b/blogger-importer.php
index d272f50..d6fbe2a 100644
--- a/blogger-importer.php
+++ b/blogger-importer.php
@@ -3,11 +3,11 @@
 Plugin Name: Blogger Importer
 Plugin URI: http://wordpress.org/extend/plugins/blogger-importer/
 Description: Import posts, comments, and tags from a Blogger blog and migrate authors to Wordpress users.
 Author: wordpressdotorg
 Author URI: http://wordpress.org/
-Version: 0.6
+Version: 0.5
 License: GPLv2
 License URI: http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
 */
 
 if (!defined('WP_LOAD_IMPORTERS'))
@@ -927,13 +927,16 @@ if (class_exists('WP_Importer'))
         function restart()
         {
             global $wpdb;
             $options = get_option('blogger_importer');
 
-            delete_option('blogger_importer');
-            $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
+            if ( check_admin_referer( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ) ) {
+                delete_option('blogger_importer');
+                $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
+            }
             wp_redirect('?import=blogger');
+            exit;
         }
 
         // Step 9: Congratulate the user
         function congrats()
         {
@@ -981,11 +984,13 @@ if (class_exists('WP_Importer'))
             {
                 $restart = __('Restart', 'blogger-importer');
                 $message = __('We have saved some information about your Blogger account in your WordPress database. Clearing this information will allow you to start over. Restarting will not affect any posts you have already imported. If you attempt to re-import a blog, duplicate posts and comments will be skipped.',
                     'blogger-importer');
                 $submit = esc_attr__('Clear account information', 'blogger-importer');
-                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'><p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
+                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'>";
+                wp_nonce_field( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ); 
+                echo "<p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
             }
         }
 
         function save_vars()
         {
diff --git a/readme.txt b/readme.txt
index c9baaa7..d75740a 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,12 +1,12 @@
 === Plugin Name ===
 Contributors: wordpressdotorg, Otto42, Workshopshed, SergeyBiryukov, rmccue
 Donate link: 
 Tags: importer, blogger
 Requires at least: 3.0
-Tested up to: 3.4
-Stable tag: 0.5
+Tested up to: 3.6
+Stable tag: 0.6
 License: GPLv2 or later
 
 Imports posts, comments, and categories (blogger tags) from a Blogger blog then migrates authors to Wordpress users.
 
 == Description ==
@@ -93,10 +93,13 @@ The importer uses the SimplePie classes to process the data, these in turn use a
 * https://developers.google.com/blogger/docs/1.0/developers_guide_php
 * https://developers.google.com/gdata/articles/oauth
 
 == Changelog ==
 
+= 0.6 = 
+* Security improvements.
+
 = 0.5 =
 * Merged in fix by SergeyBiryukov http://core.trac.wordpress.org/ticket/16012
 * Merged in rmccue change to get_total_results to also use SimplePie from http://core.trac.wordpress.org/attachment/ticket/7652/7652-blogger.diff
 * Reviewed in rmccue's changes in http://core.trac.wordpress.org/attachment/ticket/7652/7652-separate.diff issues with date handling functions so skipped those
 * Moved SimplePie functions in  new class WP_SimplePie_Blog_Item incorporating get_draft_status and get_updated and convert date

Vulnerable code: Version: 0.6
            delete_option('blogger_importer');
            $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'><p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
Tested up to: 3.4
Stable tag: 0.5
Fixed code: Version: 0.5
            if ( check_admin_referer( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ) ) {
                delete_option('blogger_importer');
                $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
            }
            exit;
                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'>";
                wp_nonce_field( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ); 
                echo "<p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
Tested up to: 3.6
Stable tag: 0.6
= 0.6 = 
* Security improvements.