Ada Bug Security di WP 3.1.3, wajib upgrade ke versi terbaru

Teman2, sumber dari _www.exploit-db.com/exploits/17465/

Code:

SEC Consult Vulnerability Lab Security Advisory < 20110701-0 >
=======================================================================
              title: Multiple SQL Injection Vulnerabilities
            product: WordPress
 vulnerable version: 3.1.3/3.2-RC1 and probably earlier versions
      fixed version: 3.1.4/3.2-RC3
             impact: Medium
           homepage: http://wordpress.org/
              found: 2011-06-21
                 by: K. Gudinavicius                            
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================
 
Vendor description:
-------------------
"WordPress was born out of a desire for an elegant, well-architectured
personal publishing system built on PHP and MySQL and licensed under
the GPLv2 (or later). It is the official successor of b2/cafelog.
WordPress is fresh software, but its roots and development go back to
2001."
 
Source: http://wordpress.org/about/
 
 
 
Vulnerability overview/description:
-----------------------------------
Due to insufficient input validation in certain functions of WordPress
it is possible for a user with the "Editor" role to inject arbitrary
SQL commands. By exploiting this vulnerability, an attacker gains
access to all records stored in the database with the privileges of the
WordPress database user.
 
 
 
Proof of concept:
-----------------
1) The get_terms() filter declared in the wp-includes/taxonomy.php file
does not properly validate user input,  allowing an attacker with
"Editor" privileges to inject arbitrary SQL commands in the "orderby"
and "order" parameters passed as array members to the vulnerable filter
when sorting for example link categories.
 
The following URLs could be used to perform blind SQL injection
attacks:
 
http://localhost/wp-admin/edit-tags.php?taxonomy=link_category&orderby=[SQL
injection]&order=[SQL injection]
http://localhost/wp-admin/edit-tags.php?taxonomy=post_tag&orderby=[SQL
injection]&order=[SQL injection]
http://localhost/wp-admin/edit-tags.php?taxonomy=category&orderby=[SQL
injection]&order=[SQL injection]
 
 
2) The get_bookmarks() function declared in the
wp-includes/bookmark.php file does not properly validate user input,
allowing an attacker with "Editor" privileges to inject arbitrary SQL
commands in the "orderby" and "order" parameters passed as array
members to the vulnerable function when sorting links.
 
The following URL could be used to perform blind SQL injection attacks:
 
http://localhost/wp-admin/link-manager.php?orderby=[SQL
injection]&order=[SQL injection]
 
 
Vulnerable / tested versions:
-----------------------------
The vulnerability has been verified to exist in version 3.1.3 of
WordPress, which is the most recent version at the time of discovery.
 
 
Vendor contact timeline:
------------------------
2011-06-22: Contacting vendor through security () wordpress org
2011-06-22: Vendor reply, sending advisory draft
2011-06-23: Vendor confirms security issue
2011-06-30: Vendor releases patched version
2011-07-01: SEC Consult publishes advisory
 
 
 
Solution:
---------
Upgrade to version 3.1.4 or 3.2-RC3
 
 
Workaround:
-----------
A more restrictive role, e.g. "Author", could be applied to the user.
 
 
 
Advisory URL:
-------------
https://www.sec-consult.com/en/advisories.html
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH
 
Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria
 
Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
https://www.sec-consult.com
 
EOF K. Gudinavicius / @2011

Klo ga ngerti gpp . Intinya di versi 3.1.3 ada bug yang memungkinkan blog anda diambil alih oleh orang lain. Jadi diwajibkan untuk upgrade ke versi 3.1.4 atau diatasnya. Tadi malam saya barusan dapat info dari temen kalau websitenya dideface. Jangan sampai anda jadi korban berikutnya. .

 

untung ane selalu upgrade ke versi atas klo ada pemberitahuannya

tp memang kemarin cepat sekali jarak antara versi satu ke versi lain, ternyata ada bugnya to

 

musti cepetan upgrade nih...

 

wah thanks infonya. ane upgrade dl smuanya

 

,,wah pake SQL injection
nge defacenya
,untung uda upgrade

 

udah ane upgrade gan, ane paling sering dapet warning dari plugin wordpress firewall 2 tentang SQL injection

tapi ternyata pas ane telusuri, ntu IP SQL injection ternyata IP nya koneksi internet ane (kartu Three)

emang bener kata member disini kalo IP three itu berbahaya, makanye ane gak pernah berani ngebuka paypal melalui koneksi three.
takut di sama paypalnya

 

klo wordpress firewall kadang harus dimatiin dulu saat kita ngedit theme ato ngedit yang lainnya. atau diwhitelist aja.

 

untung ane udah upgrade kemaren gan. . lega deh

 

masih 3.1.2 nih ..
upgrade ah ....

 

informasi yang sangat berguna...

Thanks a lot

 

upgrade dulu ahhh...
makasih infonya...

 

kbanyakan udh ane upgrade sih..thx infonya bro

 

CMIIW, itu gk sembarang visitor yang bisa inject..
Cuma member yang berstatus "Editor"

 

masih blum diupgrade nih

upgrade dulu...

 

mluncur ke TKP gan..

 

wah belum upgrade nih udah ke hack duluan...

 

Langsung upgrade dah.. yang ngasilin duit harus di prioritaskan

 

Alhamdulillah proses upgrade ke 3.1.4 setelah kena hack selesai dan lancar
selanjutnya update plugin yang ketinggalan jaman
Anehnya kalo dulu pas update plugin gak bisa langsung dari wp admin harus lewat ftp, tapi kali ini langsung klik link update pada wordpress udah update secara otomatis.... Jadi curiga apa ada celah lagi yah... Mohon pencerahannya agan-agan.

 

iza gan,
ane korbannya,
posting ane ilang,
tabel wp-post di rusak,

buruan update atau pakek tu firewall

 

web ane semuanya kena bro...

kutu kampretttt neh orang !! dan dari script yang ditaruh ada link dari hxxp://firman.gunajaya.net