Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability

["YGN Ethical Hacker Group (http://yehg.net)" <lists () yehg net>]

Hi Cru3l.b0y

We've been seeing you keep mistakenly assuming RFI for constant variables.
For next releases of your great bug hunting journey, please note:

1. Constant variables are usually written Capital letter such as
ABSPATH, DB_USER, DB_PASSWORD, DB_HOST
2. Programmers define them in config file in advance/earlier with
define function like define( ABSPATH, ...) , define(DB_USER,...)

If this finding is automatically invoked by your own written audit
scripts, please fix it.

No offense, actually. We appreciate it.


On Fri, Jul 31, 2009 at 2:09 AM, Francesco
Laurita<francesco () francesco-laurita info> wrote:
> On Thu, 2009-07-30 at 21:49 +0430, Cru3l.b0y wrote:
> > Hi Dear,
> > I found a new bug. please publish it.
> > thank you
> > best regards
>
> Bogus.
> ABSPATH is a defined variable. You can't change its value by using a
> query string.
>
> Regards