----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
WordPress Sniplets Plugin Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA29099

VERIFY ADVISORY:
http://secunia.com/advisories/29099/

CRITICAL:
Highly critical

IMPACT:
Cross Site Scripting, Exposure of system information, Exposure of
sensitive information, System access

WHERE:
>From remote

SOFTWARE:
Sniplets 1.x (plugin for WordPress)
http://secunia.com/product/17831/

DESCRIPTION:
NBBN has discovered some vulnerabilities in the Sniplets plugin for
WordPress, which can be exploited by malicious people to conduct
cross-site scripting attacks, disclose sensitive information, or
compromise a vulnerable system.

1) Input passed to the "libpath" parameter in
modules/syntax_highlight.php is not properly verified before being
used to include files. This can be exploited to include arbitrary
files from local or external resources.

Successful exploitation of this vulnerability requires that
"register_globals" is enabled.

2) Input passed to the "text" parameter in modules/execute.php is not
properly sanitised before being used in a call to "eval()". This can
be exploited to inject and execute arbitrary PHP code via a specially
crafted parameter value.

Successful exploitation of this vulnerability requires that
"register_globals" is enabled.

3) Input passed to the "page" parameter in view/admin/pager.php is
not properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

4) Input passed to the "text" parameter in view/sniplets/warning.php,
view/sniplets/notice.php, view/sniplets/inset.php, and
modules/execute.php and "url" in view/admin/submenu.php is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

Successful exploitation of this vulnerability requires that
"register_globals" is enabled.

The vulnerabilities are confirmed in version 1.2.2. Other versions
may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly verified and
sanitised.

PROVIDED AND/OR DISCOVERED BY:
NBBN

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------