lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list] 
Message-ID: <921a8494-fb8c-883a-1402-250a8774f37c@securify.nl>
Date: Wed, 1 Mar 2017 07:11:29 +0100
From: Summer of Pwnage <lists@...urify.nl>
To: fulldisclosure@...lists.org
Subject: [FD] WordPress Adminer plugin allows public (local) database login

------------------------------------------------------------------------
WordPress Adminer plugin allows public (local) database login
------------------------------------------------------------------------
David Vaartjes, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
The Adminer WordPress plugin allows public login to the site's editor.
As a result this allows an attacker to connect to any database running
on the local host or on internal systems which are accessible from the
target WordPress server.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160728-0001

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on the Adminer WordPress Plugin
version 1.4.4.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Currently no fix for this issue is available.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/wordpress_adminer_plugin_allows_public__local__database_login.html

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists