Solution for WordPress WP-Forum 1.7.4 SQL injection

[ad]

Last week milw0rm discovered an SQL injection in WordPress Forum plugin 1.7.4 by Fredrik Fahlstad. And here I’ll provide a workaround for that.

The original bugreport is here.

This is a standard SQL injection. Based on the slubber handling of _GET parameters, and the call of forum_get_posts_by_user without type check.
The forum_show_profile function provides a buggy alias for forum_get_profile, on wp-forum.php on row 917:

function forum_show_profile(){
       return forum_get_profile($_GET['user']);
}

Let’s see, what is forum_get_profile doing. It’s found in forum_functions.php on row 363:

function forum_get_profile($user){
        global $user_ID, $table_threads, $wpdb, $rss_link, $profile_link;
        $profile = new WP_User($user);
        ...
        <td valign='top'  class='table_meta'>Recent posts: </td><td>".forum_get_posts_by_user($user, 10)."</td>
        ...

So, I guess the easiest soultion is, to patch the forum_get_profile function, before even, the WP_User class call, like this:

	$user = intval($user);
        $profile = new WP_User($user);

It forces PHP engine to convert the given $user variable to a number. In the worst case, it will produce 0, and that means it will show the admin user’s forum profile, and posts

Big deal 😉

So, that’s it.

[ad]

“Solution for WordPress WP-Forum 1.7.4 SQL injection” bejegyzéshez 2 209 hozzászólás

  1. [url=https://chloroquine.us.org/]where to buy chloroquine[/url] [url=https://cephalexin365.com/]cephalexin 500 generic[/url] [url=https://hydroxychloroquinecv.com/]hydroxychloroquine online[/url] [url=https://priligy.us.com/]buy priligy[/url] [url=https://motrin.us.com/]motrin 225 mg[/url] [url=https://prazosin.us.com/]prazosin erectile dysfunction[/url] [url=https://cialisprice.us.org/]cialis generic[/url]

  2. [url=http://prednisolone.us.org/]purchass of prednisolone tablets[/url] [url=http://tamoxifenpct.com/]tamoxifen drug[/url] [url=http://proscar.us.com/]proscar medication[/url] [url=http://retina.us.org/]generic retin a cream[/url] [url=http://cephalexin365.com/]cephalexin 750 mg[/url] [url=http://flomax.us.com/]buy flomax[/url]

  3. [url=https://priligy.us.com/]priligy price[/url] [url=https://azithromycin.us.org/]how to buy azithromycin[/url] [url=https://malegra.us.org/]buy malegra online[/url] [url=https://domperidone.us.com/]motilium 30 mg tablets[/url] [url=https://proscar.us.com/]generic proscar[/url] [url=https://hydroxychloroquine.us.com/]cost of plaquenil in us[/url] [url=https://chloroquinaralen.com/]buy aralen[/url] [url=https://duloxetine.us.com/]cymbalta online[/url] [url=https://nexium.us.org/]nexium best price[/url] [url=https://lipitor.us.org/]lipitor prescription drug[/url]

  4. catalogo price shoes urbano cinturones vaqueros para dama TWOTWINSTYLE Summer Solid Patchwork Women T Shirt O Neck Asymmetrical Sleeve Loose Tops Female Korean 2020 Fashion Clothes New TWOTWINSTYLE Summer Striped Women Dress O Neck Short Sleeve High Waist Hit Color Asymmetrical Midi Dresses Female Fashion 2020 Adyce 2020 New Summer White Tassel Bodycon Club Bandage Dress Women Sexy Spaghetti Strap Celebrity Evening Party Dress Vestidos TWOTWINSTYLE Summer Vintage Solid Women Dress V Neck Puff Sleeve High Waist Button Hollow Out Midi Dresses Female Fashion 2020 parlante bose ktronix huawei mate 20 lite funda accesorios roomba 700 montura pepe jeans vintage georges rech paris oversize leaf pin brooch silver tone 1980s che guevara red red trucker hat miraculous leaders 褌芯谢褜泻芯 写芯 14 屑邪褟 锌芯谢褍褔懈褌械 褋泻懈写泻褍 写芯 50 薪邪 胁褋械 锌谢邪褌褜褟 泻褍锌懈褌褜 泻褉芯褋褋芯胁泻懈 adidas runfalcon 褑胁械褌 褔械褉薪褘泄 斜械谢褘泄 gucci shorts hombre algod贸n beige as novas bolsas metalizadas da gucci clarissa cabeda
    newest style i love mama kids cap hat denim embroidery

  5. new america jersey 2018 msi herni pc chicago bears retro deadstock vintage shark tooth mitchell ness snapback hat puma fenty sandals price sportovn铆 pantofle puma flipflops for men zodiac hodinky omega d谩msk茅 hodinky 9527 puma tsugi shinsei nido 鏉辩€涘繊鑰?濞佽偗 鎱㈣窇闉?榛戠磪鑹?364936 01 sandals puma wild sandal injex camo inf 365082 03 soft fluo peach puma white sabelt 5 point harness installed on h bs mazda mx 5 miata supreme 18aw gore tex beanie knit cap red
    baterias de coche start stop

  6. [url=https://tamoxifenpct.com/]tamoxifen buy online[/url] [url=https://bupropion365.com/]buy bupropion[/url] [url=https://duloxetine.us.com/]duloxetine[/url] [url=https://priligy.us.com/]priligy 60mg uk[/url] [url=https://cialisprice.us.org/]buy cialis over the counter canada[/url] [url=https://amitriptyline24.com/]amitriptyline hydrochloride[/url]

  7. [url=https://malegra.us.org/]malegra online[/url] [url=https://trazodonesale.com/]trazodone buy[/url] [url=https://prednisolone.us.org/]buy prednisolone[/url] [url=https://motrin.us.com/]motrin[/url] [url=https://domperidone.us.com/]domperidone[/url] [url=https://attarax.com/]atarax 50 mg tablet[/url] [url=https://azithromycin.us.org/]azithromycin 2g[/url] [url=https://amitriptyline24.com/]elavil medication[/url]

  8. [url=http://wellbutrin.us.org/]225 mg wellbutrin[/url] [url=http://duloxetine.us.com/]cymbalta 60 mg[/url] [url=http://priligy.us.com/]generic priligy[/url]

  9. [url=http://wellbutrin.us.org/]buy wellbutrin[/url] [url=http://malegra.us.org/]buy malegra[/url] [url=http://zovirax.us.com/]zovirax cream generic[/url] [url=http://priligy.us.com/]priligy 60mg online[/url]

Vélemény, hozzászólás?

Az email címet nem tesszük közzé. A kötelező mezőket * karakterrel jelöltük