CVE-2012-10015 (published 2023-05-31T00:15Z)

A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/wp-plugins/twitter-plugin
commit_details: repo_url: https://github.com/wp-plugins/twitter-plugin
author: bestwebsoft
author_date: 2012-07-24 17:05:32+00:00
msg: V2.15 - Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.

git-svn-id: https://plugins.svn.wordpress.org/twitter-plugin/trunk@576723 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/twitter-plugin
repo_name: wp-plugins/twitter-plugin
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: twitter-ar_AR.po
change_type: ModificationType.ADD
diff: @@ -0,0 +1,136 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: twitter\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2012-07-24 20:03+0300\n"
+"PO-Revision-Date: 2012-07-24 20:03+0300\n"
+"Last-Translator: zos <zos@bestwebsoft.com>\n"
+"Language-Team: Albayan Design Hani Aladoli <info@albayan-design.com>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-KeywordsList: __;_e\n"
+"X-Poedit-Basepath: ..\n"
+"X-Poedit-Language: arabic\n"
+"X-Poedit-Country: libya\n"
+"X-Poedit-SourceCharset: utf-8\n"
+"X-Poedit-SearchPath-0: .\n"
+
+#: twitter.php:80
+msgid "Activated plugins"
+msgstr "الاضافات المفعلة "
+
+#: twitter.php:82
+#: twitter.php:90
+#: twitter.php:98
+msgid "Read more"
+msgstr "اقراء المزيد"
+
+#: twitter.php:82
+#: twitter.php:245
+#: twitter.php:254
+msgid "Settings"
+msgstr "الاعدادت "
+
+#: twitter.php:88
+msgid "Installed plugins"
+msgstr "الاضافات المركبة"
+
+#: twitter.php:96
+msgid "Recommended plugins"
+msgstr "اضافات موصي بها"
+
+#: twitter.php:98
+msgid "Download"
+msgstr "تحميل"
+
+#: twitter.php:98
+#, php-format
+msgid "Install %s"
+msgstr "تركيب %s"
+
+#: twitter.php:98
+msgid "Install now from wordpress.org"
+msgstr "نزلها الان من wordpress.org"
+
+#: twitter.php:100
+msgid "If you have any questions, please contact us via plugin@bestwebsoft.com or fill in our contact form on our site"
+msgstr "اذا كان لديك اي استفسار او سؤال الرجاء الاتصال بنا عبر بريدنا الالكتروني :  contact us via plugin@bestwebsoft.com  , او المراسلة الفورية من واجهة الاتصال بنا علي موقعنا الخاص"
+
+#: twitter.php:131
+#: twitter.php:153
+msgid "Twitter Options"
+msgstr "خيارات التويتر"
+
+#: twitter.php:131
+msgid "Twitter"
+msgstr "التويتر"
+
+#: twitter.php:149
+msgid "Options saved."
+msgstr "تم حفظ الخيارات"
+
+#: twitter.php:160
+msgid "Settings for the button \"Follow Me\":"
+msgstr "اعدادات زر \"Follow Me\":"
+
+#: twitter.php:164
+msgid "Enter your username:"
+msgstr "اكتب اسم المستخدم :"
+
+#: twitter.php:168
+msgid "If you do not have Twitter account yet you need to create it using this link"
+msgstr "اذا كنت لا تملك حساب علي التويتر يمكنك انشاء حساب جديد عبر هذه الرابط"
+
+#: twitter.php:169
+msgid "Put a shortcode [follow_me] on necessary page or post to use \"Follow Me\" button."
+msgstr "ضع هذه الكود [follow_me]في الصفحات المطلوبه او في المواضيع  \"Follow Me\" زر."
+
+#: twitter.php:170
+msgid "If you would like to utilize this button in another place, please put strings below into the template source code"
+msgstr "إذا كنت ترغب في الاستفادة من هذا الزر في مكان آخر، يرجي وضع الاعدادات في الاسفل ( مربع الكود )"
+
+#: twitter.php:174
+msgid "Settings for the button \"Twitter\":"
+msgstr "اعدادات لهذه الزر  \"Twitter\":"
+
+#: twitter.php:178
+msgid "Choose a position for an icon \"Twitter\":"
+msgstr "اختار مكان لوضع ايقونه  \"Twitter\":"
+
+#: twitter.php:181
+msgid "Top position"
+msgstr "في الاعلي "
+
+#: twitter.php:182
+msgid "Bottom position"
+msgstr "في الاسفل"
+
+#: twitter.php:183
+msgid "When clicking this sign a user adds to their twitter page article that they liked along with a link to it."
+msgstr "عند النقر على هذا العلامة على أن يضيف المستخدم إلى صفحة مقالتهم في تويتر مع روابطها"
+
+#: twitter.php:188
+msgid "Save Changes"
+msgstr "حفظ الاعدادت"
+
+#: twitter.php:224
+msgid "Click here if you liked this article."
+msgstr "اضغط هنا اذا اعجبك هذه المقال"
+
+#: twitter.php:255
+msgid "FAQ"
+msgstr "أسئلة وأجوبة"
+
+#: twitter.php:256
+msgid "Support"
+msgstr "الدعم"
+
+#~ msgid "BWS Plugins"
+#~ msgstr "Плагины BWS"
+#~ msgid "Install Now"
+#~ msgstr "Установить сейчас"
+#~ msgid "Twitter options"
+#~ msgstr "Опции Twitter"
+

programming_language: CoffeeScript
filename: twitter-he_IL.po
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Twitter Plugin v2.13\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-12 11:43+0300\n"
-"PO-Revision-Date: 2012-07-12 11:43+0300\n"
+"POT-Creation-Date: 2012-07-24 20:03+0300\n"
+"PO-Revision-Date: 2012-07-24 20:03+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: \n"
 "Language: \n"
@@ -33,8 +33,8 @@ msgstr "קרא עוד"
 
 # @ twitter
 #: twitter.php:82
-#: twitter.php:244
-#: twitter.php:253
+#: twitter.php:245
+#: twitter.php:254
 msgid "Settings"
 msgstr "הגדרות"
 
@@ -141,17 +141,17 @@ msgid "Save Changes"
 msgstr "שמור שינויים"
 
 # @ twitter
-#: twitter.php:223
+#: twitter.php:224
 msgid "Click here if you liked this article."
 msgstr "אם אהבת את המאמר לחץ כאן."
 
 # @ twitter
-#: twitter.php:254
+#: twitter.php:255
 msgid "FAQ"
 msgstr "שאלות ותשובות"
 
 # @ twitter
-#: twitter.php:255
+#: twitter.php:256
 msgid "Support"
 msgstr "תמיכה"
 

programming_language: CoffeeScript
filename: twitter-ru_RU.po
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: twitter\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-12 11:43+0300\n"
-"PO-Revision-Date: 2012-07-12 11:43+0300\n"
+"POT-Creation-Date: 2012-07-24 20:03+0300\n"
+"PO-Revision-Date: 2012-07-24 20:03+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: bestwebsoft.com <plugin@bestwebsoft.com>\n"
 "Language: \n"
@@ -28,8 +28,8 @@ msgid "Read more"
 msgstr "Читать далее"
 
 #: twitter.php:82
-#: twitter.php:244
-#: twitter.php:253
+#: twitter.php:245
+#: twitter.php:254
 msgid "Settings"
 msgstr "Настройки"
 
@@ -115,15 +115,15 @@ msgstr "При нажатии этой иконки пользователь д
 msgid "Save Changes"
 msgstr ""
 
-#: twitter.php:223
+#: twitter.php:224
 msgid "Click here if you liked this article."
 msgstr "Кликай, если понравилась данная статья."
 
-#: twitter.php:254
+#: twitter.php:255
 msgid "FAQ"
 msgstr "FAQ"
 
-#: twitter.php:255
+#: twitter.php:256
 msgid "Support"
 msgstr "Поддержка"
 

programming_language: CoffeeScript
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Donate link: https://www.2checkout.com/checkout/purchase?sid=1430388&quantity=10
 Tags: tvit, twit, twet, tvet, tvitt, twitt, twett, tvett, tviter, twiter, tweter, twiter, follow button, twitter follow button, twitter share, twitter follow, twitter share button, button, connect, twitter connect, twiter conect, tweet, tweeter, tweetter 
 Requires at least: 2.9
 Tested up to: 3.4.1
-Stable tag: 2.14
+Stable tag: 2.15
 
 Add Twitter follow button to your WordPress website.
 
@@ -23,6 +23,7 @@ Twitter plugin allows you to add follow button in the most easily and flexible w
 
 = Translation =
 
+* Arabic (ar_AR) (thanks to Albayan Design Hani Aladoli)
 * Hebrew (he_IL) (thanks to Sagive SEO)
 * Russian (ru_RU)
 
@@ -71,6 +72,10 @@ If you create your own language pack or update the existing one, you can send <a
 
 == Changelog ==
 
+= V2.15 - 24.07.2012 =
+* NEW : Arabic language file is added to the plugin.
+* Bugfix : Cross Site Request Forgery bug was fixed.
+
 = V2.14 - 10.07.2012 =
 * NEW : Hebrew language file is added to the plugin.
 * Update : We updated all functionality for wordpress 3.4.1.
@@ -134,6 +139,9 @@ If you create your own language pack or update the existing one, you can send <a
 
 == Upgrade Notice ==
 
+= V2.15 =
+Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.
+
 = V2.14 =
 Hebrew language file is added to the plugin. We updated all functionality for wordpress 3.4.1.
 

programming_language: Markdown
filename: twitter.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Plugin Name: Twitter Plugin
 Plugin URI:  http://bestwebsoft.com/plugin/
 Description: Plugin to add a link to the page author to twitter.
 Author: BestWebSoft
-Version: 2.14
+Version: 2.15
 Author URI: http://bestwebsoft.com/
 License: GPLv2 or later
 */
@@ -142,7 +142,7 @@ if (!function_exists ( 'twttr_settings_page' ) ) {
 		global $twttr_options_array;
 		$message = "";
 		$error = "";
-		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) ) {
+		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) && check_admin_referer( plugin_basename(__FILE__), 'twttr_nonce_name' ) ) {
 			$twttr_options_array['twttr_url_twitter'] = $_REQUEST['twttr_url_twitter'];
 			$twttr_options_array['twttr_position'] = $_REQUEST['twttr_position'];
 			update_option ( "twttr_options_array", $twttr_options_array );
@@ -189,6 +189,7 @@ if (!function_exists ( 'twttr_settings_page' ) ) {
 						</td>
 					</tr>
 					</table>
+					<?php wp_nonce_field( plugin_basename(__FILE__), 'twttr_nonce_name' ); ?>
 				</form>
 			</div>
 		</div>

programming_language: PHP