Hi Henri,
Thanks for raising this with us. The report is right in pointing out that those parameters aren’t sanitised (which we will address immediately). It’s work pointing out though, that this is an administration module (protected by WordPress’s user permissions); rather than one that can be access anonymously.
Our dev team are correcting this as we speak, after all, just because someone has administration privileges over our plugin, doesn’t mean we should expose the rest of the database. Once again, thanks for making us aware of this
Regards
Owen
P.S. I don’t have access to seclists, would you mind posting my response there and letting me know if there’s any followup?
Sure I can post your reply there. Thanks for fast response. As far as I can tell this does not need CVE-identifier, because of needed ACL to exploit this vulnerability. Still good to fix of course.
About the list in general:
http://lists.grok.org.uk/full-disclosure-charter.html
About CVE-identifiers:
http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures
http://cve.mitre.org/
Please notify me if you need help fixing the code.
Hi Henri,
Also wanted to point out that we actually use nonces on the admin to reduce our surface of attack, so that _GET isn’t actually exploitable.
We’re still address the direct use of querystring parameters in SQL though, just to ensure we don’t get any more false positives
Regards
Owen
