Matasano Chargen - Latest Comments in Funny WordPress Vulnerability

Re: Funny WordPress Vulnerability

chatsohbet — Tue, 30 Jun 2009 09:29:51 -0000

SOHBET
BURSA SOHBET
ISTANBUL CHAT
ISLAMI CHAT
IZMIR CHAT
ANKARA ARKADAS
ALMANYA CHAT
TURKEY CHAT
MYNET
SITENE EKLE
VIDEO KLIP IZLE

Re: Funny WordPress Vulnerability

SEO Ranter — Fri, 11 Apr 2008 05:08:10 -0000

Haha, thanks for that, very entertaining. It's disappointing that no-one's fixed this rather weak looking bit of coding (e.g. the entirety of wordpress) yet!

Re: Funny WordPress Vulnerability

Doug Steele — Sun, 17 Feb 2008 22:01:50 -0000

Interesting. There are some good ideass presented here. I need to do spend some time reading more about these topics.

Re: Funny WordPress Vulnerability

Mike Tracy — Wed, 23 Jan 2008 18:43:12 -0000

ndg: Thank you for the clarification.

Re: Funny WordPress Vulnerability

ndg — Wed, 23 Jan 2008 18:21:16 -0000

"Apparently, we’re using the is_admin() call to figure out if a user is administrator after all?"

No, it's because pending/draft posts are only displayed in the administration interface (on the "manage posts" page, etc).

The issue here is that WordPress classifies posts along two axes, published-unpublished and public-private. The exploit reveals (unpublished & public) data only; posts marked as "private" stay private, even though an administrator would be able to see them.

Re: Funny WordPress Vulnerability

Mike Tracy — Wed, 23 Jan 2008 17:29:56 -0000

And why does my blog post all of a sudden become about Tom?

Re: Funny WordPress Vulnerability

Thomas Ptacek — Wed, 23 Jan 2008 17:29:21 -0000

What does that comment even mean?

Re: Funny WordPress Vulnerability

Nate — Wed, 23 Jan 2008 17:12:12 -0000

Oh no, you're picking up the Thomas style of oblique asides. Trying to sort info from cuteness and failing...

Re: Funny WordPress Vulnerability

Mike Tracy — Wed, 23 Jan 2008 14:00:57 -0000

I'm not sure about "wrong". All that statement was intended to do was point out that the way the bug was exploited in the snippet at blackhatdomainer.com requires the use of REQUEST_URI. It was not intended to suggest a fix or in any other way condone the coding practices of the WordPress crew.

I probably should have been more clear in the idea I was expressing but I was too busy snorting a perfectly good bottle of wine out of my nose.

Re: Funny WordPress Vulnerability

Hugo — Wed, 23 Jan 2008 13:41:40 -0000

"In PHP, the difference between _SERVER[‘PHP_SELF’] and _SERVER[‘REQUEST_URI’] is that the latter also gives you the parameters that were passed to a GET request."

Perhaps by now you already know your'e wrong. PHP_SELF is as much vulnerable as REQUEST_URI.

Peace. Lets see what gobless saz :]