full-disclosure - Re: TWSL2012-002: Multiple Vulnerabilities in WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201201251450.37578.tmb@65535.com>
Date: Wed, 25 Jan 2012 14:49:42 +0000
From: Tim Brown <tmb@...35.com>
To: full-disclosure@...ts.grok.org.uk
Cc: Trustwave Advisories <TrustwaveAdvisories@...stwave.com>
Subject: Re: TWSL2012-002: Multiple Vulnerabilities in
	WordPress

On Wednesday 25 Jan 2012 15:22:39 Henri Salo wrote:

> There is A LOT of these open installation pages in the Internet. It is not
> uncommon to leave those open by accident. Some people also do this,
> because they just don't understand the risks. I am wondering if WordPress
> would apply patch if we create one as a collaborative effort. I would be
> more than happy to help creating a patch for this if this is the case.

I may have missed something, but does simply having the file exposed make you 
vulnerable.  From looking at it, it starts of with a bunch of file_exists(), 
which essentially evaluate if you've installed or not and wp_die() if you 
have.

Tim
-- 
Tim Brown
<mailto:tmb@...35.com>

Download attachment "signature.asc " of type "application/pgp-signature" (837 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/