CVE-2012-10012 (published 2023-04-10T00:15Z)

A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The patch is named 33144ae5a45ed07efe7fceca901d91365fdbf7cb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225355.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/wp-plugins/facebook-button-plugin
commit_details: repo_url: https://github.com/wp-plugins/facebook-button-plugin
author: bestwebsoft
author_date: 2012-07-24 16:40:19+00:00
msg: V2.14 - Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.

git-svn-id: https://plugins.svn.wordpress.org/facebook-button-plugin/trunk@576704 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/facebook-button-plugin
repo_name: wp-plugins/facebook-button-plugin
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: facebook-button-plugin.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Plugin Name: Facebook Button Plugin
 Plugin URI:  http://bestwebsoft.com/plugin/
 Description: Put Facebook Button in to your post.
 Author: BestWebSoft
-Version: 2.13
+Version: 2.14
 Author URI: http://bestwebsoft.com/
 License: GPLv2 or later
 */
@@ -150,7 +150,7 @@ if( ! function_exists( 'fcbk_bttn_plgn_settings_page' ) ) {
 
 		$message = "";
 		$error = "";
-		if( isset( $_REQUEST['fcbk_bttn_plgn_form_submit'] ) ) {
+		if( isset( $_REQUEST['fcbk_bttn_plgn_form_submit'] ) && check_admin_referer( plugin_basename(__FILE__), 'fcbk_bttn_plgn_nonce_name' ) ) {
 			// Takes all the changed settings on the plugin's admin page and saves them in array 'fcbk_bttn_plgn_options_array'.
 			if ( isset ( $_REQUEST['fcbk_bttn_plgn_where'] ) && isset ( $_REQUEST['fcbk_bttn_plgn_link'] ) && isset ( $_REQUEST['fcbk_bttn_plgn_display_option'] ) )	{				
 				$fcbk_bttn_plgn_options_array [ 'fcbk_bttn_plgn_link' ]			=	$_REQUEST [ 'fcbk_bttn_plgn_link' ];
@@ -412,7 +412,8 @@ if( ! function_exists( 'fcbk_bttn_plgn_settings_page' ) ) {
 							<input type="submit" class="button-primary" value="<?php _e('Save Changes') ?>" />
 						</td>
 					</tr>
-				</table>		
+				</table>
+				<?php wp_nonce_field( plugin_basename(__FILE__), 'fcbk_bttn_plgn_nonce_name' ); ?>
 			</form>
 		</div>
 	</div>

programming_language: PHP
filename: facebook-ar_AR.po
change_type: ModificationType.ADD
diff: @@ -0,0 +1,182 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: facebook\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2012-07-24 19:37+0300\n"
+"PO-Revision-Date: 2012-07-24 19:37+0300\n"
+"Last-Translator: zos <zos@bestwebsoft.com>\n"
+"Language-Team: Albayan Design Hani aladoli <info@albayan-design.com>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-KeywordsList: __;_e\n"
+"X-Poedit-Basepath: ..\n"
+"X-Poedit-Language: arabic\n"
+"X-Poedit-Country: libya\n"
+"X-Poedit-SourceCharset: utf-8\n"
+"X-Poedit-SearchPath-0: .\n"
+
+#: facebook-button-plugin.php:78
+msgid "Activated plugins"
+msgstr "الاضافات المفعله "
+
+#: facebook-button-plugin.php:80
+#: facebook-button-plugin.php:88
+#: facebook-button-plugin.php:96
+msgid "Read more"
+msgstr "اقراء المزيد"
+
+#: facebook-button-plugin.php:80
+#: facebook-button-plugin.php:519
+#: facebook-button-plugin.php:531
+msgid "Settings"
+msgstr "الاعدادات "
+
+#: facebook-button-plugin.php:86
+msgid "Installed plugins"
+msgstr "الاضافات المنزلة "
+
+#: facebook-button-plugin.php:94
+msgid "Recommended plugins"
+msgstr "اضافات موصي بها"
+
+#: facebook-button-plugin.php:96
+msgid "Download"
+msgstr "تحميل"
+
+#: facebook-button-plugin.php:96
+#, php-format
+msgid "Install %s"
+msgstr "تنزيل %s"
+
+#: facebook-button-plugin.php:96
+msgid "Install now from wordpress.org"
+msgstr "حملها الا من  wordpress.org"
+
+#: facebook-button-plugin.php:98
+msgid "If you have any questions, please contact us via plugin@bestwebsoft.com or fill in our contact form on our site"
+msgstr "اذا كان لديك اي استفسار او سؤال الرجاء الاتصال بنا عبر بريدنا الالكتروني :  contact us via plugin@bestwebsoft.com  , او المراسلة الفورية من واجهة الاتصال بنا علي موقعنا الخاص"
+
+#: facebook-button-plugin.php:109
+#: facebook-button-plugin.php:222
+msgid "FaceBook Button Options"
+msgstr "اعدادات زر الفيس بوك"
+
+#: facebook-button-plugin.php:109
+msgid "FaceBook Button"
+msgstr "زر الفيس بوك"
+
+#: facebook-button-plugin.php:169
+msgid "Options saved."
+msgstr "تم حفظ الاعدادات"
+
+#: facebook-button-plugin.php:191
+msgid "Error: File size > 32K"
+msgstr "خطاء : حجم الملف : > 32К"
+
+#: facebook-button-plugin.php:194
+msgid "Error: Invalid file type"
+msgstr "خطاء : نوع الملف غير صحيح"
+
+#: facebook-button-plugin.php:204
+msgid "Error: moving file failed"
+msgstr "خطاء : فشل في نقل الملف"
+
+#: facebook-button-plugin.php:208
+msgid "Error: check image width or height"
+msgstr "خطاء : تأكد من عرض وطول الصورة"
+
+#: facebook-button-plugin.php:213
+msgid "Uploading Error: check image properties"
+msgstr "خطاء في الرفع : تأكد من خصائص الصورة"
+
+#: facebook-button-plugin.php:229
+msgid "Your's FaceBook Id:"
+msgstr "اسم حسابك علي الفيس بوك :"
+
+#: facebook-button-plugin.php:235
+msgid "Display button:"
+msgstr "عرض الزر :"
+
+#: facebook-button-plugin.php:237
+msgid "My Page"
+msgstr "صفحتي"
+
+#: facebook-button-plugin.php:238
+msgid "Like"
+msgstr "اعجاب "
+
+#: facebook-button-plugin.php:243
+msgid "Choose display option:"
+msgstr "اختار خيار العرض :"
+
+#: facebook-button-plugin.php:247
+msgid "Standart FaceBook image"
+msgstr "صورة الفيس بوك الافتراضية "
+
+#: facebook-button-plugin.php:249
+msgid "Custom FaceBook image"
+msgstr "صورة خاصة للـ فيس بوك"
+
+#: facebook-button-plugin.php:256
+msgid "Current image:"
+msgstr "الصورة الحالية : "
+
+#: facebook-button-plugin.php:269
+msgid "FaceBook image:"
+msgstr "صورة الفيس بوك : "
+
+#: facebook-button-plugin.php:273
+msgid "Image properties: max image width:100px; max image height:40px; max image size:32Kb; image types:\"jpg\", \"jpeg\"."
+msgstr "Propiedades de la imagen: Ancho máx.: 100px; Alto máx.: 40px; Tamaño máx: 32Kb; Tipo de imagen: \"jpg\", \"jpeg\"."
+
+#: facebook-button-plugin.php:281
+msgid "FaceBook Button Position:"
+msgstr "مكان زر الفيس بوك :"
+
+#: facebook-button-plugin.php:285
+msgid "Before"
+msgstr "قبل"
+
+#: facebook-button-plugin.php:286
+msgid "After"
+msgstr "بعد"
+
+#: facebook-button-plugin.php:287
+msgid "Before and After"
+msgstr "قبل و بعد"
+
+#: facebook-button-plugin.php:288
+msgid "Shortcode"
+msgstr "الكود"
+
+#: facebook-button-plugin.php:290
+msgid "If you would like to add a FaceBook button to your website, just copy and put this shortcode onto your post or page:"
+msgstr "اذا كنت ترغب في اضافة زر الفيس بوك علي موقعك انسخ هذه الكود وضعه في المكان المراد ظهور الزر فيه"
+
+#: facebook-button-plugin.php:295
+msgid "FaceBook Button language:"
+msgstr "للغه زر الفيس بوك :"
+
+#: facebook-button-plugin.php:406
+msgid "Select language for Like button"
+msgstr "اختار اللغه للـ زر الاغحاب"
+
+#: facebook-button-plugin.php:412
+msgid "Save Changes"
+msgstr "حفظ التغييرات"
+
+#: facebook-button-plugin.php:532
+msgid "FAQ"
+msgstr "أسئلة وأجوبة"
+
+#: facebook-button-plugin.php:533
+msgid "Support"
+msgstr "الدعم"
+
+#~ msgid "Install Now"
+#~ msgstr "Установить сейчас"
+#~ msgid "BWS Plugins"
+#~ msgstr "Плагины BWS"
+

programming_language: CoffeeScript
filename: facebook-es_ES.po
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: facebook\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-10 19:07+0300\n"
-"PO-Revision-Date: 2012-07-10 19:07+0300\n"
+"POT-Creation-Date: 2012-07-24 19:37+0300\n"
+"PO-Revision-Date: 2012-07-24 19:37+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: bestwebsoft.com <plugin@bestwebsoft.com>\n"
 "Language: \n"
@@ -28,8 +28,8 @@ msgid "Read more"
 msgstr "Leer mas"
 
 #: facebook-button-plugin.php:80
-#: facebook-button-plugin.php:518
-#: facebook-button-plugin.php:530
+#: facebook-button-plugin.php:519
+#: facebook-button-plugin.php:531
 msgid "Settings"
 msgstr "Opciones"
 
@@ -168,11 +168,11 @@ msgstr ""
 msgid "Save Changes"
 msgstr ""
 
-#: facebook-button-plugin.php:531
+#: facebook-button-plugin.php:532
 msgid "FAQ"
 msgstr "FAQ"
 
-#: facebook-button-plugin.php:532
+#: facebook-button-plugin.php:533
 msgid "Support"
 msgstr "Soporte"
 

programming_language: CoffeeScript
filename: facebook-he_IL.po
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Facebook Button Plugin\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-10 19:06+0300\n"
-"PO-Revision-Date: 2012-07-10 19:06+0300\n"
+"POT-Creation-Date: 2012-07-24 19:37+0300\n"
+"PO-Revision-Date: 2012-07-24 19:37+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: \n"
 "Language: \n"
@@ -33,8 +33,8 @@ msgstr "קרא עוד"
 
 # @ facebook
 #: facebook-button-plugin.php:80
-#: facebook-button-plugin.php:518
-#: facebook-button-plugin.php:530
+#: facebook-button-plugin.php:519
+#: facebook-button-plugin.php:531
 msgid "Settings"
 msgstr "הגדרות"
 
@@ -206,12 +206,12 @@ msgid "Save Changes"
 msgstr "שמור שינויים"
 
 # @ facebook
-#: facebook-button-plugin.php:531
+#: facebook-button-plugin.php:532
 msgid "FAQ"
 msgstr "שאלות ותשובות"
 
 # @ facebook
-#: facebook-button-plugin.php:532
+#: facebook-button-plugin.php:533
 msgid "Support"
 msgstr "תמיכה"
 

programming_language: CoffeeScript
filename: facebook-ru_RU.po
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: facebook\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-10 19:07+0300\n"
-"PO-Revision-Date: 2012-07-10 19:07+0300\n"
+"POT-Creation-Date: 2012-07-24 19:37+0300\n"
+"PO-Revision-Date: 2012-07-24 19:37+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: bestwebsoft.com <plugin@bestwebsoft.com>\n"
 "Language: \n"
@@ -28,8 +28,8 @@ msgid "Read more"
 msgstr "Подробнее..."
 
 #: facebook-button-plugin.php:80
-#: facebook-button-plugin.php:518
-#: facebook-button-plugin.php:530
+#: facebook-button-plugin.php:519
+#: facebook-button-plugin.php:531
 msgid "Settings"
 msgstr "Настройки"
 
@@ -167,11 +167,11 @@ msgstr "Выберите язык для Like кнопки"
 msgid "Save Changes"
 msgstr ""
 
-#: facebook-button-plugin.php:531
+#: facebook-button-plugin.php:532
 msgid "FAQ"
 msgstr "FAQ"
 
-#: facebook-button-plugin.php:532
+#: facebook-button-plugin.php:533
 msgid "Support"
 msgstr "Поддержка"
 

programming_language: CoffeeScript
filename: facebook-tr_TR.po
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: facebook\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-10 19:07+0300\n"
-"PO-Revision-Date: 2012-07-10 19:07+0300\n"
+"POT-Creation-Date: 2012-07-24 19:37+0300\n"
+"PO-Revision-Date: 2012-07-24 19:37+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: bestwebsoft.com <plugin@bestwebsoft.com>\n"
 "Language: \n"
@@ -28,8 +28,8 @@ msgid "Read more"
 msgstr "Devamını Oku"
 
 #: facebook-button-plugin.php:80
-#: facebook-button-plugin.php:518
-#: facebook-button-plugin.php:530
+#: facebook-button-plugin.php:519
+#: facebook-button-plugin.php:531
 msgid "Settings"
 msgstr "Ayarlar"
 
@@ -167,11 +167,11 @@ msgstr ""
 msgid "Save Changes"
 msgstr "Değişiklikleri Kaydet"
 
-#: facebook-button-plugin.php:531
+#: facebook-button-plugin.php:532
 msgid "FAQ"
 msgstr "SSS (Sık Sorulan Sorular)"
 
-#: facebook-button-plugin.php:532
+#: facebook-button-plugin.php:533
 msgid "Support"
 msgstr "Destek"
 

programming_language: CoffeeScript
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Donate link: https://www.2checkout.com/checkout/purchase?sid=1430388&quantity=10
 Tags: Facebook, Facebook Button, Like, Like button, Share, Share button, Facebook like, Facebook like button, Facebook button like, Button like, Facebook share, Facebook share button, Facebook button share
 Requires at least: 2.9
 Tested up to: 3.4.1
-Stable tag: 2.13
+Stable tag: 2.14
 
 Add Facebook button to your WordPress website
 
@@ -24,6 +24,7 @@ Facebook Button Plugin allows you to add follow button in the most easiest and f
 
 = Translation =
 
+* Arabic (ar_AR) (thanks to Albayan Design Hani Aladoli)
 * Hebrew (he_IL) (thanks to Sagive SEO)
 * Russian (ru_RU)
 * Spanish (es_ES) (thanks to Jesús Parra)
@@ -80,6 +81,10 @@ Dear users, if you have any questions or propositions regarding our plugins (cur
 
 == Changelog ==
 
+= V2.14 - 24.07.2012 =
+* NEW : Arabic language file is added to the plugin.
+* Bugfix : Cross Site Request Forgery bug was fixed. 
+
 = V2.13 - 10.07.2012 =
 * NEW : Hebrew language file is added to the plugin.
 * Update : We updated all functionality for wordpress 3.4.1.
@@ -133,6 +138,9 @@ Dear users, if you have any questions or propositions regarding our plugins (cur
 
 == Upgrade Notice ==
 
+= V2.14 =
+Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed. 
+
 = V2.13 =
 Hebrew language file is added to the plugin. We updated all functionality for wordpress 3.4.1.
 

programming_language: Markdown