Bugtraq mailing list archives
Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability
From: "YGN Ethical Hacker Group (http://yehg.net)" <lists () yehg net>
Date: Fri, 31 Jul 2009 05:25:48 +0630
Hi Cru3l.b0y We've been seeing you keep mistakenly assuming RFI for constant variables. For next releases of your great bug hunting journey, please note: 1. Constant variables are usually written Capital letter such as ABSPATH, DB_USER, DB_PASSWORD, DB_HOST 2. Programmers define them in config file in advance/earlier with define function like define( ABSPATH, ...) , define(DB_USER,...) If this finding is automatically invoked by your own written audit scripts, please fix it. No offense, actually. We appreciate it. On Fri, Jul 31, 2009 at 2:09 AM, Francesco Laurita<francesco () francesco-laurita info> wrote:
On Thu, 2009-07-30 at 21:49 +0430, Cru3l.b0y wrote:Hi Dear, I found a new bug. please publish it. thank you best regardsBogus. ABSPATH is a defined variable. You can't change its value by using a query string. Regards
Current thread:
- wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability Cru3l.b0y (Jul 30)
- Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability Francesco Laurita (Jul 30)
- Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability YGN Ethical Hacker Group (http://yehg.net) (Jul 31)
- Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability Francesco Laurita (Jul 30)