Posts Tagged ‘security’

Newer Entries »

2 Plugin Security Bulletins

10
responses
by
on
February 7th, 2008
in
WordPress Plugins, WordPress Security

NBBN has discovered some cross site scripting vulnerabilities for the WP-Footnotes plugin version 2.2 for WordPress. Input passed to the “pre_footnotes”, “priority”, “post_footnotes”, and “style_rules” array elements in the “wp_footnotes_current_settings[]” array in the admin_panel.php script is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site. The good news this time around is that, ‘register_globals‘ must be turned on for exploitation to occur. If you are using this plugin on your site, it is advised that you disable the plugin until a security patch has been released. According to the security bulletin, the solution is to edit the plugin source code to ensure that input is properly sanitized. Again, if you know that your webserver has register_globals turned off, you are in the clear. S@BUN has reported an “id” […]

[Continue Reading...]

Matt Cutts On Securing WP

19
responses
by
on
January 22nd, 2008
in
LinkyLoo, WordPress Security

Matt Cutts has published an article which highlights three different ways to secure your WordPress installation. The first tip involves locking down your Admin directory. Matt configures his .hatccess file so that only his IP address is allowed to access the WP-Admin directory. For the second tip, you should create a blank index.html file to place into your wp-content/plugins directory. Not doing so allows your plugin folder to be wide open, giving nosy people an idea as to what plugins you have installed. Matt’s third and final tip involves subscribing to the official WordPress development blog – http://wordpress.org/development/feed/ As we should all know by now, this is the best way to stay up to date. Matt also offers a bonus tip where he suggest removing the line of code within your header.php file that publishes your WordPress version. All of these are excellent tips. But what do you do to […]

[Continue Reading...]

WP-Forum Plugin Security Bulletin

148
responses
by
on
January 21st, 2008
in
WordPress Plugins, WordPress Security

If you are currently using the latest release of the WP-Forum plugin, listen up. The websec security team has discovered a vulnerability within this plugin that can be exploited by malicious users to conduct SQL injection attacks. According to Secunia: Input passed to the “user” parameter in the WordPress installation’s index.php script (when “forumaction” is set to “showprofile” and “page_id” to a page with the “<!–WPFORUM–>” tag) is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. This vulnerability when exploited successfully allows the individual to retrieve usernames, password hashes, and email addresses for all users, including administrators. However, the user has to have knowledge of the proper database table prefix. This vulnerability has been confirmed in version 1.7.4 which is currently the most recent version available for download. Description: WP-Forum is a WordPress plugin that enables […]

[Continue Reading...]

NEWER POSTS »


Obviously Powered by WordPress. © 2003-2013

css.php