[Full-disclosure] Full Path Disclosure in most wordpress' plugins [?]



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Exists an call to add_action() without validate with function_exists().
When I run the php script directly, I get the full path of wp installation.

Example:
[+] http://www.marco2010.cl/wp-content/plugins/akismet/akismet.php
[+] http://www.marco2010.cl/wp-content/plugins/hello.php


Is a bug? Is a feature?

More details posted in my blog:
http://blog.zerial.org/seguridad/vulnerabilidad-en-la-mayoria-de-los-plugins-para-wordpress/
(spanish)


cheers.
- --
Zerial
Desarrollador y Programador Web
Seguridad Informatica
Linux User #382319
Blog: http://blog.zerial.org
Skype: erzerial
Jabber: zerial@xxxxxxxxxxxx
GTalk && MSN: fernando@xxxxxxxxxx

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkrAwpgACgkQIP17Kywx9JRciQCfZeWYvflVpdSeZ+a+BM3Z6hV3
0yUAn08Kan+JbtR13aUxMkw0FzUi+W0r
=/0dj
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Window sizing buttons
    ... Herb Tyson MS MVP ... Blog: http://word2007bible.herbtyson.com ... Before trying that, however, I would try creating a new Windows user on ... amiss with your installation on that computer, almost as if one of the ...
    (microsoft.public.word.docmanagement)
  • Re: Cant get outlook express for SERVICE PACK 2, so how do I get i
    ... After my 4th installation I have been able to get ... My Blog, Defending Your Machine, ... || once had in Outlook Express but imported to Outlook and archived! ...
    (microsoft.public.windowsxp.general)
  • Re: Ausschaltproblem
    ... Hast du die Installation noch einmal mit der 64bit ... nach was für Hardware du wirklich auf den fraglichen Maschinen hast. ... This message is signed using GnuPG, ... Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ ...
    (de.comp.os.unix.linux.misc)
  • Re: Spelling Grammar Dialog Box Explain button missing
    ... I wasn't talking about putting a new installation on the machine... ... Herb Tyson MS MVP ... Blog: http://word2007bible.herbtyson.com ...
    (microsoft.public.word.spelling.grammar)
  • Re: Update rollup 2 -Arrons blog
    ... Continue researching Aaron Stebner's blog. ... have been bugged with a RollUp 2 installation problem. ... For your version of Media Center ...
    (microsoft.public.windows.mediacenter)