myeasybackup has backdoor equivalent security vulnerability

  • list2010@lunch.za.net

    (@list2010lunchzanet)


    13 years, 3 months ago

    If you install myeasybackup 1.0.5.3 (16 December 2010), unauthenticated anonymous outsiders can

    [details removed for obvious reasons]

    and thereby run arbitary code of their choice. It looks like there are a host of similar holes in other parts of the code (meb_settings.php), but marginally more complex to exploit.

    This code is either amateurish, or deliberately written to be exploitable (conditionally assigning values to $_POST?? What is that? It is either sloppy stupidity, or evil genius).

    IMHO, avoid this software until it has had a proper security review.

    http://wordpress.org/extend/plugins/myeasybackup/

Viewing 9 replies - 1 through 9 (of 9 total)
  • esmi

    (@esmi)

    13 years, 3 months ago

    Have you tried contacting the plugin’s developer about this?

    Plugin Author ugosinhache

    (@camaleo)

    13 years, 3 months ago

    @list2010@lunch.za.net please get in touch and I will fix whatever in needed.
    http ://myeasywp.com

    Thank you,
    camaleo

    Plugin Author ugosinhache

    (@camaleo)

    13 years, 2 months ago

    @list2010@lunch.za.net

    This code is either amateurish, or deliberately written to be exploitable (conditionally assigning values to $_POST?? What is that? It is either sloppy stupidity, or evil genius).

    My humble opinion: nobody is perfect and nobody has the total knowledge on everything.

    IMHO, avoid this software until it has had a proper security review.

    Don be shy, please let me know what’s wrong in detail, check out the modifications in a private beta and let the people know the plugin is ok with your security standards.

    Its a good chance to give something back to the open source community and a better attitude rather than pointing the finger and hiding, do you agree?

    Please get in touch at http://myeasywp.com/contact/

    thank you

    hamhere

    (@hamhere)

    12 years, 6 months ago

    Update – I may have made this post to hastily. I did not check which version of MyEasybackup I had installed. According to the plugin website a security fix was implemented in July.

    Plugin Author ugosinhache

    (@camaleo)

    12 years, 6 months ago

    @hamhere,

    did you get the info by installing and using the WSD plugin or did you sign up and ran a remote service?

    Just to know how can I proceed to find out how to fix this issue.

    thanks

    hamhere

    (@hamhere)

    12 years, 6 months ago

    I had used WSD Plugin and had the product installed for many months, probably since last 2010. I just recently installed webdefender.

    Plugin Author ugosinhache

    (@camaleo)

    12 years, 6 months ago

    I just installed the WSD plugin and run a “Scan Reports” but the problem is not shown.

    I am using WSD Plugin 0.4 and myEASYbackup 1.0.8.1: are you using the same versions?

    hamhere

    (@hamhere)

    12 years, 6 months ago

    I confirm the error is gone. So sorry for jumping the gun and flagging the error when I had not done proactive problem determination on my part.

    Thank you for the useful plug in.

    Plugin Author ugosinhache

    (@camaleo)

    12 years, 6 months ago

    Glad to see the problem is gone!

Viewing 9 replies - 1 through 9 (of 9 total)
  • The topic ‘myeasybackup has backdoor equivalent security vulnerability’ is closed to new replies.