Vulnerability Bulletins |
Cross-Site Request Forgery (CSRF)/PHP Object Injection Vulnerability in Jayj Quicktag |
|
| Affected software | Wordpress |
|
https://www.pluginvulnerabilities.com/2017/08/28/cross-site-request-forgery-csrfphp-object-injection-vulnerability-in-jayj-quicktag/We recently found that the plugin Jayj Quicktag contained a cross-site request forgery (CSRF)/PHP object injection vulnerability. The plugin’s settings page is generated with the function jayj_quicktag_options_page() in the file /jayj-quicktag.php. In that file if the POST input “jayj-quicktag-import-save” exists then the maybe_unserialize() More info: https://www.pluginvulnerabilities.com/2017/08/28/cross-site-request-forgery-csrfphp-object-injection-vulnerability-in-jayj-quicktag/ |
|