TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Object injection vulnerability enables remote code execution in WordPress 3.6

48 点作者 mathias超过 11 年前

3 条评论

IgorPartola超过 11 年前
An old (2.x) version of WordPress I worked on included an eval() statement that amounted to basically just doing variable assignment. I am sure there was some reason for this (probably not a good one), but it turned me off to the WordPress core. The fact that every WP release is quickly followed up with a patch for some critical remote code execution vulnerability tells me that there is something systematically wrong with its handling of user input and security.<p>Because of that, I moved off WordPress for personal blogging and onto Pelican [1]. You can&#x27;t compromise static content.<p>[1] <a href="http://docs.getpelican.com/en/3.2/" rel="nofollow">http:&#x2F;&#x2F;docs.getpelican.com&#x2F;en&#x2F;3.2&#x2F;</a>
评论 #6375418 未加载
评论 #6375154 未加载
评论 #6375080 未加载
评论 #6376390 未加载
cryptbe超过 11 年前
Cool research. I like how you &quot;connect-the-dots&quot; from the benign-looking MySQL&#x27;s behaviour to the bad code in Wordpress. This reminds me of <a href="http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/" rel="nofollow">http:&#x2F;&#x2F;www.suspekt.org&#x2F;2008&#x2F;08&#x2F;18&#x2F;mysql-and-sql-column-trunc...</a>.<p>I&#x27;m surprised that the fix in Wordpress wasn&#x27;t explicitly marking fields that need to be serialized&#x2F;unserialized, instead of second-guessing based on the broken promise by MySQL.<p>&gt; MySQL replaces characters it doesn’t recognize (for the given character set), with a placeholder. MySQL will sometimes replace byte sequences with “?” or “�” (U+FFFD). Such replacements would not be harmful.<p>This is so wrong. A database must never change any data that it&#x27;s asked to stored. Wordpress, and other applications, always make that assumption, and when it isn&#x27;t true anymore all hell breaks loose.<p>PS: it blows my mind that it looks like strpos in PHP could return either boolean or integer [1].<p>[1] <a href="http://core.trac.wordpress.org/browser/tags/3.6.1/wp-includes/functions.php#L0" rel="nofollow">http:&#x2F;&#x2F;core.trac.wordpress.org&#x2F;browser&#x2F;tags&#x2F;3.6.1&#x2F;wp-include...</a>
评论 #6375633 未加载
评论 #6376090 未加载
评论 #6375621 未加载
satyap超过 11 年前
WordPress is the PHP of web frameworks....<p>I&#x27;ll be in the corner.