bugtraq - Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 31 Jul 2009 05:25:48 +0630
From: "YGN Ethical Hacker Group (http://yehg.net)" <lists@...g.net>
To: francesco@...ncesco-laurita.info
Cc: "Cru3l.b0y" <cru3l.b0y@...il.com>,
	vuldb <vuldb@...urityfocus.com>, vuln <vuln@...unia.com>,
	"Vladimir '3APA3A' Dubrovin" <3APA3A@...urity.nnov.ru>,
	bugtraq@...urityfocus.com, submit@...w0rm.com,
	secalert@...urityreason.com, submissions@...ketstormsecurity.org
Subject: Re: wordpress plugins wp-Table v1.52 Remote File Inclusion 
	Vulnerability

Hi Cru3l.b0y

We've been seeing you keep mistakenly assuming RFI for constant variables.
For next releases of your great bug hunting journey, please note:

1. Constant variables are usually written Capital letter such as
ABSPATH, DB_USER, DB_PASSWORD, DB_HOST
2. Programmers define them in config file in advance/earlier with
define function like define( ABSPATH, ...) , define(DB_USER,...)

If this finding is automatically invoked by your own written audit
scripts, please fix it.

No offense, actually. We appreciate it.

On Fri, Jul 31, 2009 at 2:09 AM, Francesco
Laurita<francesco@...ncesco-laurita.info> wrote:
> On Thu, 2009-07-30 at 21:49 +0430, Cru3l.b0y wrote:
>> Hi Dear,
>> I found a new bug. please publish it.
>> thank you
>> best regards
>
> Bogus.
> ABSPATH is a defined variable. You can't change its value by using a
> query string.
>
> Regards
>
>