Security question

  • Resolved Erick

    (@relozo)


    4 months, 4 weeks ago

    Hi,

    Hope you’re well.

    Does using unserialize cause a security issue within your plugin?

    /updraftplus/includes/PEAR/HTTP/Request2/CookieJar.php at line 440

    Using unserialize is well known for causing remote code execution issues when unserializing untrusted input. This is caused by unserialize’s support for creation of random PHP objects.

Viewing 3 replies - 1 through 3 (of 3 total)
  • nrobertsudp

    (@nrobertsudp)

    4 months, 4 weeks ago

    Hi Erick,

    Thanks for your message.

    I’ve forwarded it to development and will update with any feedback I receive.

    Best regards,

    Nick

    Plugin Support vupdraft

    (@vupdraft)

    4 months, 1 week ago

    This tores cookies and passes them between HTTP requests

    It’s meant for php V5 so you can ignore it if you are not using this.

    https://snipboard.io/qrtbFx.jpg

    Thread Starter Erick

    (@relozo)

    4 months ago

    Hi @vupdraft

    I got another one

    updraftplus/central/modules/core.php#L620

    Using phpinfo() can expose the entire server configuration to your users, including every environment variable.

    Would you be able to advise please?

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.

  • 3 replies
  • 3 participants
  • Last reply from: Erick
  • Last activity: 4 months ago
  • Status: resolved