bugtraq - Re: Wordpress 1.2.2 is still vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041221215651.25242.qmail@www.securityfocus.com>
Date: 21 Dec 2004 21:56:51 -0000
From: Thomas Waldegger <bugtraq@...ph3us.org>
To: bugtraq@...urityfocus.com
Subject: Re: Wordpress 1.2.2 is still vulnerable


In-Reply-To: <20041216062119.9218.qmail@....securityfocus.com>

Sry, but it's getting ridiculous.
The new releases of wordpress - 1.2.2 stable and 
1.3-alpha-5 unstable - are still vulnerable for
some bugs I mentioned in my last message.

XSS:
/wp-login.php?action=login&redirect_to=[XSS]
/wp-admin/templates.php?file=[XSS]
/wp-admin/post.php?content=[XSS]

SQL Errors:
/index.php?m=bla
/wp-admin/edit.php?m=bla

PHP-Warnings:
/wp.php?author=bla
/wp-commentsrss2.php?p=999999
/wp-admin/options.php?option_group_id=1888
/wp-admin/post.php?action=edit&post=2890000000000