Timeline for Vulnerability in closed plugin Yuzo Related Posts [closed]
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 24 '19 at 17:05 | review | Reopen votes | |||
| Apr 24 '19 at 18:08 | |||||
| Apr 24 '19 at 16:29 | comment | added | Martijn Pieters♦ | Sorry, Stack Overflow is not suitable for help me find vulnerabilities in this random plugin questions. We can answer specific, focused questions with a limited scope. | |
| Apr 24 '19 at 16:28 | history | closed |
Robert Columbia Martijn Pieters♦ |
Needs more focus | |
| Apr 24 '19 at 16:10 | review | Close votes | |||
| Apr 24 '19 at 16:30 | |||||
| Apr 24 '19 at 15:43 | audit | First posts | |||
| Apr 24 '19 at 15:43 | |||||
| Apr 17 '19 at 23:04 | audit | First posts | |||
| Apr 17 '19 at 23:18 | |||||
| Apr 17 '19 at 11:38 | audit | First posts | |||
| Apr 17 '19 at 12:07 | |||||
| Apr 12 '19 at 6:35 | audit | Close votes | |||
| Apr 12 '19 at 7:47 | |||||
| Apr 11 '19 at 20:03 | history | protected | Community♦ | ||
| Apr 10 '19 at 18:47 | comment | added | Pat Mc | it also appears this url will respond with the same payload regardless of the query string | |
| Apr 10 '19 at 18:44 | comment | added | Pat Mc | looks like hellofromhony.org/scriptmyjs?t=1&/wp-includes/js/jquery/… is causing the issue on a site I just looked into with this issue. This link does not supply jquery. | |
| Apr 10 '19 at 15:24 | history | edited | fealXX | CC BY-SA 4.0 |
edited title
|
| Apr 10 '19 at 13:51 | comment | added | fealXX | @Hendrik yes, that is correct. Wordpress prefixes the options automatically with the plugin identifier, so with this simple attack only the plugin-owned Options can be modified | |
| Apr 10 '19 at 13:36 | comment | added | Stefan | For reference, this is the payload served by the mentioned exploit, hosted on hellofromhony.org: gist.github.com/stefan2904/a31a676b6fc202d2c6428acd728ad791 | |
| Apr 10 '19 at 12:53 | comment | added | Hendrik | Am I correct to assume only the wp-options regarding the plugin itself can be manipulated? I'm trying to find the maximum reach of the vulnerability. | |
| Apr 10 '19 at 11:37 | comment | added | fealXX | Nice, thanks, did not find that when googling for known vulnerabilitys. Added that to my answer below, so Google will relate it... :) | |
| Apr 10 '19 at 11:29 | comment | added | Hang Guan | Someone has also written about this as early as March 30. pluginvulnerabilities.com/2019/03/30/… | |
| Apr 10 '19 at 11:12 | answer | fealXX | timeline score: 9 | ||
| Apr 10 '19 at 10:44 | comment | added | fealXX | While investigating & writing this post, two threads have appeared on the wordpress.org board: wordpress.org/support/plugin/yuzo-related-post | |
| Apr 10 '19 at 10:42 | history | asked | fealXX | CC BY-SA 4.0 |