Posted 1 year ago #
No CVE-identifier yet assigned, but sherl0ck_ found security issue from this module. Have you already received information about this? Have you already started working on a patch?
Original advisory: http://seclists.org/fulldisclosure/2011/Sep/121
Best regards,
Henri Salo
Posted 1 year ago #
Hi Henri,
Thanks for raising this with us. The report is right in pointing out that those parameters aren't sanitised (which we will address immediately). It's work pointing out though, that this is an administration module (protected by WordPress's user permissions); rather than one that can be access anonymously.
Our dev team are correcting this as we speak, after all, just because someone has administration privileges over our plugin, doesn't mean we should expose the rest of the database. Once again, thanks for making us aware of this
Regards
Owen
P.S. I don't have access to seclists, would you mind posting my response there and letting me know if there's any followup?
Posted 1 year ago #
Sure I can post your reply there. Thanks for fast response. As far as I can tell this does not need CVE-identifier, because of needed ACL to exploit this vulnerability. Still good to fix of course.
About the list in general:
http://lists.grok.org.uk/full-disclosure-charter.html
About CVE-identifiers:
http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures
http://cve.mitre.org/
Please notify me if you need help fixing the code.
Posted 1 year ago #
Hi Henri,
Also wanted to point out that we actually use nonces on the admin to reduce our surface of attack, so that _GET isn't actually exploitable.
We're still address the direct use of querystring parameters in SQL though, just to ensure we don't get any more false positives
Regards
Owen
This topic has been closed to new replies.
