Security Advisory SA49850 - WordPress GD Star Rating Plugin Export Security Bypass Security Issue

Secunia

Blog

Secunia Advisory SA49850

WordPress GD Star Rating Plugin Export Security Bypass Security Issue

Secunia Advisory

SA49850

Release Date

2012-07-25

Last Update

2012-07-26

Popularity

3,755 views

Comments

0 comments

Criticality level

Moderately critical

Impact

Exposure of sensitive information

Where

From remote

Authentication level

This information is available to Secunia VIM customers

Report reliability

This information is available to Secunia VIM customers

Solution Status

Vendor Patch

Systems affected

This information is available to Secunia VIM customers

Approve distribution

This information is available to Secunia VIM customers

Software:

WordPress GD Star Rating Plugin 1.x

Secunia CVSS Score

This information is available to Secunia VIM Customers

CVE Reference(s)

No CVE references.

Description

Charlie Eriksen has discovered a security issue in the GD Star Rating plugin for WordPress, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to a missing authentication and authorisation check in the wp-content/plugins/gd-star-rating/export.php script and can be exploited to access otherwise restricted functionality and export potentially sensitive information (e.g. user names, votes, email, and IP addresses).

The security issue is confirmed in version 1.9.18. Prior versions may also be affected.

Solution
Update to version 1.9.19 or later.

Provided and/or discovered by
Charlie Eriksen via Secunia.

Changelog
Further details available to Secunia VIM customers

Original Advisory
WordPress GD Star Rating Plugin:
http://wordpress.org/extend/plugins/gd-star-rating/changelog/
http://plugins.trac.wordpress.org/changeset/576629/gd-star-rating

Charlie Eriksen:
http://ceriksen.com/Advisories/11

Deep Links
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: WordPress GD Star Rating Plugin Export Security Bypass Security Issue

No posts yet

Secunia Advisory SA49850

WordPress GD Star Rating Plugin Export Security Bypass Security Issue

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?