Graffiti CMS Arbitrary File Upload Vulnerability
It seems the FCKeditor’s bug is the same I discovered in Graffiti CMS. If anyone is interested, the details are published in milw0rm.
It seems the FCKeditor’s bug is the same I discovered in Graffiti CMS. If anyone is interested, the details are published in milw0rm.
It seems that it is time to start blogging again.
As you may already know, WordPress 2.3 has been released yesterday and many folks around the world are sharing their upgrade experiences. The one that caught my attention was the “5 Step Failsafe upgrade for WordPress” published at BlogSecurity.
Not offense intended but I wonder why a blog dedicated to security recommends an insecure backup plugin that can allow anyone to download database backups or any file from the file system.
If you are planning to upgrade your WordPress blog, just try to do manual steps because many backup plugins are very insecure — if you still want to use some of them, deactivate it when the upgrade process is completed.
Alex, why am I not surprised you have another vulnerability to share
Is the vul public?
I hope you keep us in the loop champ! I think BlogSec may even sponsor this plugin, it may have some bugs, buts its an absolutely awesome project!
Alex, BackUpWordPress is a beta release, I haven’t had too much support from experienced WordPress users until now. Please tell me more about the vulnerabilities you find in the plugin. Thanks a lot in advace!
Alex, a bug-fix release of BackUpWordPress was released this moment. The plugin’s backup repository is now secured by .htaccess. I also have added capabilities to the Plugin, to allow the blog admin to download backup archives.
Thans a lot for pointing out security issues in BackUpWordPress!
Alex, I’m happy to see some WordPress core developers having a look at my plugins. I have set up a forum (http://wpforum.designpraxis.at/) for support, bug reports, troubleshooting etc., if you happen to run into more security issues with my stuff, please let me know!
Update: Joseph Scott has made a better manifest file.
As you may already know, WordPress 2.3 will have built-in tag support and to enable tags on Windows Live Writer you have to upload a manifest file to your blog’s root.
With any luck we’ll be shipping a WLW manifest file with WordPress 2.3. I’m finishing up some items related to this right now.
Doesn’t look like it will make it into 2.3 after all, but you can get the files from this ticket:
http://trac.wordpress.org/ticket/5023
Once 2.3 is out the door I plan to spend some time cleaning up XML-RPC, including the issues you brought up in that email.
Is this necessary with 2.6
James 11:39 pm on September 17, 2008 Enlace permanente
Hi, I found your blog on this new directory of WordPress Blogs at blackhatbootcamp.com/listofwordpressblogs. I dont know how your blog came up, must have been a typo, i duno. Anyways, I just clicked it and here I am. Your blog looks good. Have a nice day. James.
mad 7:10 pm on October 14, 2008 Enlace permanente
Superb motivator! Do you have it at a higher resulotion, I\’d like to print it ^_^