Fork me on Github
Fork me on Github

Joe Dog Software

Proudly serving the Internets since 1999

WordPress Vulnerability: wp-super-cache

By jdfulmer | Published April 8, 2015 | Leave a comment

spaghetti-codeWhenever someone says “PHP sucks!” Your JoeDog assumes they got that impression from WordPress. It uses inline programming tags that mix logic with content. Whenever you do that, the result is always a nice heaping mound of spaghetti code.

PHP doesn’t have to be coded this way. The there are plenty of nice frameworks which support model-view-controller. Your JoeDog uses WordPress because he likes it as a blogging platform. He blogs on this site more often than he codes it; a cost-benefit analysis leads him to WordPress.

He also opens himself to vulnerabilities. Oh, look! Here’s another one now: Persistent XSS in WP-Super-Cache. Your JoeDog uses that module. What’s wrong with it?

Using this vulnerability, an attacker using a carefully crafted query could insert malicious scripts to the plugin’s cached file listing page. As this page requires a valid nonce in order to be displayed, a successful exploitation would require the site’s administrator to have a look at that particular section, manually.

Fortunately, the fix is already out. If you’re also using wp-super-cache, make sure you’re running version 1.1.4. This is a dangerous vulnerability which is easy to exploit. Get up to date or get out of the game.

NOTE: Your JoeDog considers PHP a rather elegant language. It’s many bad implementations and design decisions that make it seem like Suck.



Check Your Inputs: SQL Injection Edition

By jdfulmer | Published October 20, 2014 | Leave a comment

Here’s a question which tends to make Your JoeDog cringe: “So, what do you do?”

It’s often asked when he has a drink in his hand. And when he has a drink in hand, he doesn’t want to talk about work. Sometimes the inquiring person hears the answer, parses “computers” and wants to know why their laptop is slow. Honestly, Your JoeDog has no idea. Occasionally, he meets another nerd who wants to talk shop.

Recently he met a web nerd, the kind of web nerd who suffers from illusory superiority because he lacks the skill to recognize his ineptitude. These guys often contain a conspiratorial streak. This guy was no exception. The conversation soon shifted to hacking and web security.

Web Nerd puked a word salad of vulnerabilities but his beloved PHP was exonerated. “You can’t inject SQL because the mysql libs don’t allow multiple statements,” he said.

Couple points. 1.) the PHP mysql_ functions are deprecated. Astute JoeDog readers use PDO or MySQLi. 2.) You can still do injection as long as you keep it in a single statement.

Let’s try that after the jump!

Continue reading Check Your Inputs: SQL Injection Edition