WordPress 'wp-admin/admin.php' Module Configuration Security Bypass Vulnerability
BID:38233
Info
WordPress 'wp-admin/admin.php' Module Configuration Security Bypass Vulnerability
| Bugtraq ID: | 38233 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 13 2010 12:00AM |
| Updated: | Feb 16 2010 08:51PM |
| Credit: | Thomas Mackenzie |
| Vulnerable: |
WordPress WordPress 2.9 |
| Not Vulnerable: | |
Discussion
WordPress 'wp-admin/admin.php' Module Configuration Security Bypass Vulnerability
WordPress is prone to a security-bypass vulnerability.
Authenticated attackers may exploit this issue to access certain content that may contain sensitive information.
The issue affects WordPress 2.9 and later version.
WordPress is prone to a security-bypass vulnerability.
Authenticated attackers may exploit this issue to access certain content that may contain sensitive information.
The issue affects WordPress 2.9 and later version.
Exploit / POC
WordPress 'wp-admin/admin.php' Module Configuration Security Bypass Vulnerability
An attacker can exploit this issue via a browser.
An attacker can exploit this issue via a browser.
Solution / Fix
WordPress 'wp-admin/admin.php' Module Configuration Security Bypass Vulnerability
Solution:
Reportedly, a fix is available in the SVN repository. Please contact the vendor for more information.
Solution:
Reportedly, a fix is available in the SVN repository. Please contact the vendor for more information.
References
WordPress 'wp-admin/admin.php' Module Configuration Security Bypass Vulnerability
References:
References:
- WordPress >= 2.9 Failure to Restrict URL Access (Thomas Mackenzie)
- Wordpress church_admin Plugin "id" Cross-Site Scripting Vulnerability (Sammy Forgit)