WordPress.org

Ready to get started?Download WordPress

Forums

WordPress Auction Plugin
[resolved] [Plugin: WP Auctions] WordPress Auctions plugin (4 posts)

  1. henrisalo
    Member
    Posted 2 years ago #

    No CVE-identifier yet assigned, but sherl0ck_ found security issue from this module. Have you already received information about this? Have you already started working on a patch?

    Original advisory: http://seclists.org/fulldisclosure/2011/Sep/121

    Best regards,
    Henri Salo

    http://wordpress.org/extend/plugins/wp-auctions/

  2. owencutajar
    Member
    Plugin Author

    Posted 2 years ago #

    Hi Henri,

    Thanks for raising this with us. The report is right in pointing out that those parameters aren't sanitised (which we will address immediately). It's work pointing out though, that this is an administration module (protected by WordPress's user permissions); rather than one that can be access anonymously.

    Our dev team are correcting this as we speak, after all, just because someone has administration privileges over our plugin, doesn't mean we should expose the rest of the database. Once again, thanks for making us aware of this

    Regards

    Owen

    P.S. I don't have access to seclists, would you mind posting my response there and letting me know if there's any followup?

  3. henrisalo
    Member
    Posted 2 years ago #

    Sure I can post your reply there. Thanks for fast response. As far as I can tell this does not need CVE-identifier, because of needed ACL to exploit this vulnerability. Still good to fix of course.

    About the list in general:
    http://lists.grok.org.uk/full-disclosure-charter.html
    About CVE-identifiers:
    http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures
    http://cve.mitre.org/

    Please notify me if you need help fixing the code.

  4. owencutajar
    Member
    Plugin Author

    Posted 2 years ago #

    Hi Henri,

    Also wanted to point out that we actually use nonces on the admin to reduce our surface of attack, so that _GET isn't actually exploitable.

    We're still address the direct use of querystring parameters in SQL though, just to ensure we don't get any more false positives

    Regards

    Owen

Topic Closed

This topic has been closed to new replies.

About this Plugin

About this Topic