UK Researchers Warn of Serious WordPress PHP Flaw

guest · Aug 17, 2018

UK Researchers Warn of Serious WordPress PHP Flaw
August 17, 2018
https://www.infosecurity-magazine.com/news/uk-researchers-serious-wordpress/

A British researcher has published details of a serious WordPress flaw left unfixed for over a year which could allow for complete system compromise.

Sam Thomas, head of research at Secarma, presented the paper — It’s a PHP Unserialization Vulnerability Jim, but Not as We Know It — to attendees at the BSides conference in Manchester on Thursday.

By uploading a specially crafted file to the targeted app, attackers can trigger a file operation through the "phar://" stream wrapper. That in turn triggers eXternal Entity (XXE – XML) and Server Side Request Forgery (SSRF) flaws which force the app to "unserialize" metadata contained in the file, potentially resulting in execution of malicious code.
Click to expand...

Dermot7 · Aug 20, 2018

By John Leyden 20 Aug 2018 at 12:40

A newly discovered WordPress flaw has left installs of the ubiquitous content management system potentially vulnerable to hacking.
Click to expand...

https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/

After careful analysis and a review of available material, El Reg's security desk has concluded claims of a "massive WordPress vulnerability" are a load of tribble's testicles.

There's an issue here but the premise that millions of websites are at risk of "complete system compromise" above and beyond the general widely known risk of running WordPress hasn't been substantiated by Secarma, a security business owned by hosting outfit UKFast.
Click to expand...

Log in or Sign up

UK Researchers Warn of Serious WordPress PHP Flaw

guest Guest

Dermot7 Registered Member

Log in or Sign up

UK Researchers Warn of Serious WordPress PHP Flaw

guest Guest

Dermot7 Registered Member

Useful Searches