WordPress rawurlencode Vulnerability
Intro
xy7 found an information disclosure vulnerability in WordPress <= 2.0.6.
It looks like this vulnerability is limited to information leakage only. If you want to test your WP installation see below.
Test if you are vulnerable (most likely):
http://my_wordpress/index.php?m[]=
OR
http://my_wordpress/?m[]=
Temporary fix:
Note: Always make backups before making any changes.
As a temporary fix we ensure that the input being passed to the rawurlencode function is a string and not an array which is what is causing the problems.
- edit wp-includes/classes.php
- Go to line 1663
- The line should look like this:
if (isset($this->query_vars[$wpvar]) && ” != $this->query_vars[$wpvar]) { - Add the following (after the above-mentioned line):
if(!is_string($this->query_vars[$wpvar])) {
$this->query_vars[$wpvar] = ‘fixed’;
}
Summary
If I hear of WordPress releasing an official patch I will update this post.
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
[...] בוורדפרס. ×”×¤×¢× ×ž×“×•×‘×¨ בבקשת HTTP שעשויה לשמש לחשיפת מידע מוורדפרס. כל הגרס×ות, כולל 2.0.5 המעוברתת, ו-2.0.6 הל×, חשופות. [...]