WordPress 任意文件删除漏洞修复

July 31, 2018Comments

近日RIPS曝出wordpress直至 4.9.6的版本依然存在一个任意文件删除漏洞，拥有author及类似权限的wordpress站点受到此漏洞威胁，攻击者可通过构造附件的'thumb'路径造成任意文件删除。严重的后果将导致攻击者获取站点管理员权限进而控制服务器。

修复方法：(post.php为修复后的)

diff post.php.2018-07-23 post.php
5175c5175
< function wp_update_attachment_metadata( $attachment_id, $data ) {
---
> function wp_update_attachment_metadata( $attachment_id, $data ) { if(isset($data['thumb'])){$data['thumb'] = basename($data['thumb']);}

diff post.php.2018-07-23 post.php

5175c5175

< function wp_update_attachment_metadata( $attachment_id, $data ) {

---

> function wp_update_attachment_metadata( $attachment_id, $data ) { if(isset($data['thumb'])){$data['thumb'] = basename($data['thumb']);}

文章源自 note.t4x.orgByrd's Blog-https://note.t4x.org/other/wordpress-file-delete-to-code-execution/

参考文档：https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/?spm=5176.2020520154.sas.162.215f79d6cb4YoT文章源自 note.t4x.orgByrd's Blog-https://note.t4x.org/other/wordpress-file-delete-to-code-execution/ 文章源自 note.t4x.orgByrd's Blog-https://note.t4x.org/other/wordpress-file-delete-to-code-execution/

申明：除非注明Byrd's Blog内容均为原创,未经许可禁止转载!详情请阅读版权申明!

On this day in past years

July

2014Apache 服务启动、停止脚本

Hot search

On this day in past years

Comment