Re: TWSL2012-002: Multiple Vulnerabilities in WordPress

[Tim Brown <tmb () 65535 com>]

On Wednesday 25 Jan 2012 15:22:39 Henri Salo wrote:

> There is A LOT of these open installation pages in the Internet. It is not
> uncommon to leave those open by accident. Some people also do this,
> because they just don't understand the risks. I am wondering if WordPress
> would apply patch if we create one as a collaborative effort. I would be
> more than happy to help creating a patch for this if this is the case.

I may have missed something, but does simply having the file exposed make you 
vulnerable.  From looking at it, it starts of with a bunch of file_exists(), 
which essentially evaluate if you've installed or not and wp_die() if you 
have.

Tim
-- 
Tim Brown
<mailto:tmb () 65535 com>

Attachment: signature.asc
Description: This is a digitally signed message part.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/