Support » Plugin: WordPress Auction Plugin » [Plugin: WP Auctions] WordPress Auctions plugin

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author owencutajar

    (@owencutajar)

    Hi Henri,

    Thanks for raising this with us. The report is right in pointing out that those parameters aren’t sanitised (which we will address immediately). It’s work pointing out though, that this is an administration module (protected by WordPress’s user permissions); rather than one that can be access anonymously.

    Our dev team are correcting this as we speak, after all, just because someone has administration privileges over our plugin, doesn’t mean we should expose the rest of the database. Once again, thanks for making us aware of this

    Regards

    Owen

    P.S. I don’t have access to seclists, would you mind posting my response there and letting me know if there’s any followup?

    Sure I can post your reply there. Thanks for fast response. As far as I can tell this does not need CVE-identifier, because of needed ACL to exploit this vulnerability. Still good to fix of course.

    About the list in general:
    http://lists.grok.org.uk/full-disclosure-charter.html
    About CVE-identifiers:
    http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures
    http://cve.mitre.org/

    Please notify me if you need help fixing the code.

    Plugin Author owencutajar

    (@owencutajar)

    Hi Henri,

    Also wanted to point out that we actually use nonces on the admin to reduce our surface of attack, so that _GET isn’t actually exploitable.

    We’re still address the direct use of querystring parameters in SQL though, just to ensure we don’t get any more false positives

    Regards

    Owen

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘[Plugin: WP Auctions] WordPress Auctions plugin’ is closed to new replies.