近日RIPS曝出wordpress直至 4.9.6的版本依然存在一个任意文件删除漏洞，拥有author及类似权限的wordpress站点受到此漏洞威胁，攻击者可通过构造附件的'thumb'路径造成任意文件删除。严重的后果将导致攻击者获取站点管理员权限进而控制服务器。
修复方法：(post.php为修复后的)
|
0 1 2 3 4 |
diff post.php.2018-07-23 post.php 5175c5175 < function wp_update_attachment_metadata( $attachment_id, $data ) { --- > function wp_update_attachment_metadata( $attachment_id, $data ) { if(isset($data['thumb'])){$data['thumb'] = basename($data['thumb']);} |
参考文档：https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/?spm=5176.2020520154.sas.162.215f79d6cb4YoTSourceByrd's Weblog-https://note.t4x.org/other/wordpress-file-delete-to-code-execution/ SourceByrd's Weblog-https://note.t4x.org/other/wordpress-file-delete-to-code-execution/
申明：除非注明Byrd's Blog内容均为原创,未经许可禁止转载!详情请阅读版权申明!
