full-disclosure - Re: WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d5d5430f0911120742o4e34981bv639046454bacd78f@mail.gmail.com>
Date: Thu, 12 Nov 2009 09:42:21 -0600
From: g30rg3_x <g30rg3x@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: WordPress <= 2.8.5 Unrestricted File Upload
	Arbitrary PHP Code Execution

The same thing was discussed on WP-Hackers list[1] and it was found
that the problem was introduced by Option +Multiviews[2]...
And also someone point that Option +Multiviews is enabled by default
on cpanel/whm[3] based servers therefore lots of cheap (and not so
cheap) shared hosting providers introduce this behavior that could
potentially be harmful not just to wordpress but any software that
handles uploads and respect the uploaded file extensions.

Regards

[1] http://lists.automattic.com/pipermail/wp-hackers/2009-November/thread.html#28450
[2] http://lists.automattic.com/pipermail/wp-hackers/2009-November/028466.html
[3] http://lists.automattic.com/pipermail/wp-hackers/2009-November/028482.html

_________________________
             g30rg3_x

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/