CVE-2012-10015 (Other, published 2023-05-31T00:15Z)
Description: value: A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wp-plugins/twitter-plugin
Files changed:
languages/twitter-ar_AR.po
languages/twitter-he_IL.po
languages/twitter-ru_RU.po
readme.txt
twitter.php
Commit message: V2.15 - Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.

git-svn-id: https://plugins.svn.wordpress.org/twitter-plugin/trunk@576723 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
"POT-Creation-Date: 2012-07-12 11:43+0300\n"
"PO-Revision-Date: 2012-07-12 11:43+0300\n"
#: twitter.php:244
#: twitter.php:253
#: twitter.php:223
#: twitter.php:254
#: twitter.php:255
"POT-Creation-Date: 2012-07-12 11:43+0300\n"
"PO-Revision-Date: 2012-07-12 11:43+0300\n"
#: twitter.php:244
#: twitter.php:253
#: twitter.php:223
#: twitter.php:254
#: twitter.php:255
Stable tag: 2.14
Version: 2.14
		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) ) {

Fixed code:
msgid ""
msgstr ""
"Project-Id-Version: twitter\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2012-07-24 20:03+0300\n"
"PO-Revision-Date: 2012-07-24 20:03+0300\n"
"Last-Translator: zos <zos@bestwebsoft.com>\n"
"Language-Team: Albayan Design Hani Aladoli <info@albayan-design.com>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Poedit-KeywordsList: __;_e\n"
"X-Poedit-Basepath: ..\n"
"X-Poedit-Language: arabic\n"
"X-Poedit-Country: libya\n"
"X-Poedit-SourceCharset: utf-8\n"
"X-Poedit-SearchPath-0: .\n"

#: twitter.php:80
msgid "Activated plugins"
msgstr "الاضافات المفعلة "

#: twitter.php:82
#: twitter.php:90
#: twitter.php:98
msgid "Read more"
msgstr "اقراء المزيد"

#: twitter.php:82
#: twitter.php:245
#: twitter.php:254
msgid "Settings"
msgstr "الاعدادت "

#: twitter.php:88
msgid "Installed plugins"
msgstr "الاضافات المركبة"

#: twitter.php:96
msgid "Recommended plugins"
msgstr "اضافات موصي بها"

#: twitter.php:98
msgid "Download"
msgstr "تحميل"

#: twitter.php:98
#, php-format
msgid "Install %s"
msgstr "تركيب %s"

#: twitter.php:98
msgid "Install now from wordpress.org"
msgstr "نزلها الان من wordpress.org"

#: twitter.php:100
msgid "If you have any questions, please contact us via plugin@bestwebsoft.com or fill in our contact form on our site"
msgstr "اذا كان لديك اي استفسار او سؤال الرجاء الاتصال بنا عبر بريدنا الالكتروني :  contact us via plugin@bestwebsoft.com  , او المراسلة الفورية من واجهة الاتصال بنا علي موقعنا الخاص"

#: twitter.php:131
#: twitter.php:153
msgid "Twitter Options"
msgstr "خيارات التويتر"

#: twitter.php:131
msgid "Twitter"
msgstr "التويتر"

#: twitter.php:149
msgid "Options saved."
msgstr "تم حفظ الخيارات"

#: twitter.php:160
msgid "Settings for the button \"Follow Me\":"
msgstr "اعدادات زر \"Follow Me\":"

#: twitter.php:164
msgid "Enter your username:"
msgstr "اكتب اسم المستخدم :"

#: twitter.php:168
msgid "If you do not have Twitter account yet you need to create it using this link"
msgstr "اذا كنت لا تملك حساب علي التويتر يمكنك انشاء حساب جديد عبر هذه الرابط"

#: twitter.php:169
msgid "Put a shortcode [follow_me] on necessary page or post to use \"Follow Me\" button."
msgstr "ضع هذه الكود [follow_me]في الصفحات المطلوبه او في المواضيع  \"Follow Me\" زر."

#: twitter.php:170
msgid "If you would like to utilize this button in another place, please put strings below into the template source code"
msgstr "إذا كنت ترغب في الاستفادة من هذا الزر في مكان آخر، يرجي وضع الاعدادات في الاسفل ( مربع الكود )"

#: twitter.php:174
msgid "Settings for the button \"Twitter\":"
msgstr "اعدادات لهذه الزر  \"Twitter\":"

#: twitter.php:178
msgid "Choose a position for an icon \"Twitter\":"
msgstr "اختار مكان لوضع ايقونه  \"Twitter\":"

#: twitter.php:181
msgid "Top position"
msgstr "في الاعلي "

#: twitter.php:182
msgid "Bottom position"
msgstr "في الاسفل"

#: twitter.php:183
msgid "When clicking this sign a user adds to their twitter page article that they liked along with a link to it."
msgstr "عند النقر على هذا العلامة على أن يضيف المستخدم إلى صفحة مقالتهم في تويتر مع روابطها"

#: twitter.php:188
msgid "Save Changes"
msgstr "حفظ الاعدادت"

#: twitter.php:224
msgid "Click here if you liked this article."
msgstr "اضغط هنا اذا اعجبك هذه المقال"

#: twitter.php:255
msgid "FAQ"
msgstr "أسئلة وأجوبة"

#: twitter.php:256
msgid "Support"
msgstr "الدعم"

#~ msgid "BWS Plugins"
#~ msgstr "Плагины BWS"
#~ msgid "Install Now"
#~ msgstr "Установить сейчас"
#~ msgid "Twitter options"
#~ msgstr "Опции Twitter"

"POT-Creation-Date: 2012-07-24 20:03+0300\n"
"PO-Revision-Date: 2012-07-24 20:03+0300\n"
#: twitter.php:245
#: twitter.php:254
#: twitter.php:224
#: twitter.php:255
#: twitter.php:256
"POT-Creation-Date: 2012-07-24 20:03+0300\n"
"PO-Revision-Date: 2012-07-24 20:03+0300\n"
#: twitter.php:245
#: twitter.php:254
#: twitter.php:224
#: twitter.php:255
#: twitter.php:256
Stable tag: 2.15
* Arabic (ar_AR) (thanks to Albayan Design Hani Aladoli)
= V2.15 - 24.07.2012 =
* NEW : Arabic language file is added to the plugin.
* Bugfix : Cross Site Request Forgery bug was fixed.

= V2.15 =
Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.

Version: 2.15
		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) && check_admin_referer( plugin_basename(__FILE__), 'twttr_nonce_name' ) ) {
					<?php wp_nonce_field( plugin_basename(__FILE__), 'twttr_nonce_name' ); ?>