Peaches Posted July 11, 2009 Report Share Posted July 11, 2009 Vulnerabilities in WordPress - Update Security services provider Core Security has warned of an vulnerability in the processing of certain URLs in the popular WordPress blogging software, leading to various security problems. For example, unprivileged but registered users are reportedly able to examine the configuration pages of plug-ins and to change their options.The "admin.php" dashboard component, which doesn't test access rights correctly, is to blame. Core Labs has listed some sample URLs in its report to show how the plug-ins – including the WP module for the PHPIDS (PHP-Intrusion Detection System) – can be manipulated.The "Related Ways To Take Action" plug-in is affected by a number of cross-site scripting vulnerabilities that let an attacker run his own JavaScript in a victim's browser to, for example, read the contents of cookies on a victim's system. Another problem is that the login page handles incorrect user names and passwords differently to correct names and passwords and as a result an attacker might be able to guess a valid user name. The mail interface also acts erratically when a new password is requested.details at Heise security - http://www.h-online.com/security/Vulnerabi...e--/news/113730>>>>>>>>>>>>>>>>> Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.