[wp-trac] [WordPress Trac] #3988: Sanitize pagenow in admin-header.php

[WordPress Trac]

#3988: Sanitize pagenow in admin-header.php
----------------------+-----------------------------------------------------
 Reporter:  xknown    |       Owner:  anonymous
     Type:  defect    |      Status:  new      
 Priority:  normal    |   Milestone:  2.1.3    
Component:  Security  |     Version:  2.1.2    
 Severity:  normal    |    Keywords:           
----------------------+-----------------------------------------------------
 In admin-header.php there's a wp_enqueue_script call that uses the value
 of pagenow variable, it should be sanitized before output.

 PS. Thursday I've sent to security at wordpress.org a PoC that uses this
 variable to perform an XSS/CSRF attack.

-- 
Ticket URL: <http://trac.wordpress.org/ticket/3988>
WordPress Trac <http://trac.wordpress.org/>
WordPress blogging software