CVE-2013-10027 (published 2023-06-04T14:15Z)

A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/wp-plugins/blogger-importer
commit_details: repo_url: https://github.com/wp-plugins/blogger-importer
author: dllh
author_date: 2013-10-08 14:29:47+00:00
msg: Adding a nonce to prevent CSRF.



git-svn-id: https://plugins.svn.wordpress.org/blogger-importer/trunk@784566 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/blogger-importer
repo_name: wp-plugins/blogger-importer
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: blogger-importer.php
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@ Plugin URI: http://wordpress.org/extend/plugins/blogger-importer/
 Description: Import posts, comments, and tags from a Blogger blog and migrate authors to Wordpress users.
 Author: wordpressdotorg
 Author URI: http://wordpress.org/
-Version: 0.6
+Version: 0.5
 License: GPLv2
 License URI: http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
 */
@@ -929,9 +929,12 @@ if (class_exists('WP_Importer'))
             global $wpdb;
             $options = get_option('blogger_importer');
 
-            delete_option('blogger_importer');
-            $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
+            if ( check_admin_referer( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ) ) {
+                delete_option('blogger_importer');
+                $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
+            }
             wp_redirect('?import=blogger');
+            exit;
         }
 
         // Step 9: Congratulate the user
@@ -983,7 +986,9 @@ if (class_exists('WP_Importer'))
                 $message = __('We have saved some information about your Blogger account in your WordPress database. Clearing this information will allow you to start over. Restarting will not affect any posts you have already imported. If you attempt to re-import a blog, duplicate posts and comments will be skipped.',
                     'blogger-importer');
                 $submit = esc_attr__('Clear account information', 'blogger-importer');
-                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'><p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
+                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'>";
+                wp_nonce_field( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ); 
+                echo "<p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
             }
         }
 

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -3,8 +3,8 @@ Contributors: wordpressdotorg, Otto42, Workshopshed, SergeyBiryukov, rmccue
 Donate link: 
 Tags: importer, blogger
 Requires at least: 3.0
-Tested up to: 3.4
-Stable tag: 0.5
+Tested up to: 3.6
+Stable tag: 0.6
 License: GPLv2 or later
 
 Imports posts, comments, and categories (blogger tags) from a Blogger blog then migrates authors to Wordpress users.
@@ -95,6 +95,9 @@ The importer uses the SimplePie classes to process the data, these in turn use a
 
 == Changelog ==
 
+= 0.6 = 
+* Security improvements.
+
 = 0.5 =
 * Merged in fix by SergeyBiryukov http://core.trac.wordpress.org/ticket/16012
 * Merged in rmccue change to get_total_results to also use SimplePie from http://core.trac.wordpress.org/attachment/ticket/7652/7652-blogger.diff

programming_language: Markdown