CVE-2013-10029 (published 2023-06-05T21:15Z)

A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.10 is able to address this issue. The patch is named fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230671.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/wp-plugins/wordpress-exit-box-lite
commit_details: repo_url: https://github.com/wp-plugins/wordpress-exit-box-lite
author: angrybyte
author_date: 2013-05-28 17:47:25+00:00
msg: added security checks to avoid full path disclosure, XSS, unprivileged manipulation 

git-svn-id: https://plugins.svn.wordpress.org/wordpress-exit-box-lite/trunk@719474 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/wordpress-exit-box-lite
repo_name: wp-plugins/wordpress-exit-box-lite
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: wordpress-exit-box-lite.php
change_type: ModificationType.MODIFY
diff: @@ -3,18 +3,21 @@
 /**
  * @package Wordpress Exit Box Lite
  * @author Bouzid Nazim Zitouni
- * @version 1.06
+ * @version 1.10
  */
 /*
 Plugin Name: Wordpress Exit Box Lite
 Plugin URI: http://angrybyte.com/wordpress-plugins/wordpress-exit-box-finally-released/
 Description: Wordpress exit box is used design and display your exit box, a ThickBox page that will be shown to your users when they click a external link.
 Author: Bouzid Nazim Zitouni
-Version: 1.06
+Version: 1.10
 Author URI: http://angrybyte.com
 */
 
-
+if(!function_exists('add_action')){
+    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
+    die;
+}
 add_option("exitboxcontents",
     '<h2 style="text-align: center;">It was nice having you! We hope you enjoyed your stay.</h2>',
     'Contents of the Exit page', 'yes');
@@ -88,8 +91,7 @@ function exitboxadmin()
 }
 function exit_box_admin()
 {
-
-    if ($_POST['xx'])
+     if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_box_save', 'exit_box_nonce' ))
     {
 
         if (is_numeric($_POST['exitboxwidth']) || $_POST['exitboxwidth'] == "auto")
@@ -129,7 +131,7 @@ EOFT;
     {
         echo "<textarea name='xx' cols='150' rows='20'>$oldtemp</textarea>";
     }
-
+    wp_nonce_field( 'exit_box_save','exit_box_nonce' ); 
     echo <<< EOFT
 
   <br/>

programming_language: PHP