Not logged in | Login

My Security Planet » BlogSecurity » May 31, 2008

Feeds

13607 items (0 unread) in 75 feeds

WebSecurity

Security

SEO

SEO

Tools

Tools

Opensourcetesting.org News

BlogSecurity

WordPress Upload File Plugin SQL Injection

Posted: May 31st, 2008, 3:31pm CDT by Philipp

Tags: Advisories [edit]

A SQL Injection vulnerability has been reported in WordPress by the Balsec Team. The advisory is lacking alot of detail.

This post will be updated as new information is made available.
WordPress 2.3.3 Directory Traversal Vulnerability

Posted: May 31st, 2008, 3:26pm CDT by Philipp

Tags: Advisories [edit]

Sandor Attila Gerendi found a vulnerability within WordPress 2.3.3, which under certain circumstances allows an attacker to run arbitrary PHP code on WordPress 2.3.3.

Input passed via the “cat” parameter to index.php is not properly sanitised in the “get_category_template()” function in wp-includes/theme.php before being used to include files in template-loader.php. This can be exploited to include arbitrary PHP files from local resources via directory traversal attacks.

According to the advisory, successful exploitation allows execution of arbitrary PHP code, but requires privileges to store PHP files on an affected system and that WordPress is installed on a Windows platform.

The vulnerability is confirmed in version 2.3.3.

Solution:
Update to version 2.5.1.

If you wish to patch your 2.3.3 install, please see the WordPress Trac.
WordPress 2.5.1 Malicious File Execution

Posted: May 31st, 2008, 3:18pm CDT by Philipp

Tags: Advisories [edit]

CWH Underground have published an advisory regarding a malicious file execution vulnerability in WordPress 2.5.1.

We do not quite follow this advisory. The vulnerability discusses the idea of uploading a PHP backdoor onto a WordPress blog via the upload file facility, or via the plugin edit facility. I don’t think this is really a WordPress issue but rather the correct functionality of WordPress.

We have discussed before in our WordPress Whitepaper that the file upload facility should be restricted to trusted users only. We also recommend you reading our Role Management post.

← May 17 (1 item) June 9 (1 item) →