djbaxter

Administrator
Administrator
Moderator
Joined
Jun 28, 2012
Messages
3,498
Reaction score
1,634
Update WP Super Cache and W3TC Immediately ? Remote Code Execution Vulnerability Disclosed
by Tony Perez, Sucuri.net
April 23, 2013

Shame on us for not catching this a month ago when it was first reported, but it seems that two of the biggest caching plugins in WordPress have what we would classify a very serious vulnerability ? remote code execution (RCE), a.k.a., arbitrary code execution....

A really simple way to test is leave yourself a comment like this:

<!?mfunc echo PHP_VERSION; ?><!?/mfunc?>

If it works, it?ll show you something like this:

Screen-Shot-2013-04-23-at-5.17.32-PM.png


You can see that it?s showing the version of my server?s PHP install. No big deal right? Wrong. This means I can pass any commands I want to your server and they?ll execute, hence the term remote command execution (RCE).

In this instance all I said was echo, or print out, the version of my PHP, in it of itself is benign. Replace my echo with an eval and encode a payload and now it?s a different ball game. Case in point, a backdoor shell, all while going via your comments and bypassing all other authentication controls.

Again, not an issue to be taken lightly, this is a very serious vulnerability, further exasperated by the fact that any user can exploit it. The easiest way to protect yourself is to upgrade. You can find the latest updates on the WordPress.org repository:


Read more...
 
Similar threads
Thread starter Title Forum Replies Date
djbaxter Core Web Vitals and the Page Experience Update Google Algorithm Discussions 4
rustybrick Google Local ranking update? Google Algorithm Discussions 11
NevenaIvanova Need help with business detail update of a Chinese business Local Search 3
Niki Gross Tracking Variables Removed After Dec. Update Google My Business & Google Maps 1
D Should I Bother Updating NAP on Business Listings and 3rd Party Sites? Citations 7
nathangdavidson Anyone noticed Website fields not being updated in GMB, even though approved? Google My Business & Google Maps 5
Hammer Can't enter verification code due to error "To verify your listing, update your business info" All Things Google My Business [PRIVATE] (LocalU) 3
NickB-Tampa Why does Google keep updating changing the main category on our listings to ones that don't make as much sense? NAP, Categories, Dashboard Data 2
S GMB Address Update for SAB Google My Business & Google Maps 2
djbaxter Google December 2020 core update now fully rolled out Google News: Important Changes & Features 0
Dino Google not updating an address. Any ideas? Moving or Name Changes 2
hajnasiewicz How To Update a logo in Wikipedia Ask a LocalU Expert [PRIVATE] (LocalU) 4
djbaxter Forum updated to Xenforo 2.2.2 Forum Software Updates and Technical Issues 0
Professor M Google Maps Update - live status of takeout and delivery orders when you book or order from Google Maps on Android and iOS Google News: Important Changes & Features 0
Y Whenever I publish update for my local business, my local rankings drop for 3-4 days Local Search 1
djbaxter Passage Indexing: Not A Core Update. It's Ranking, Not Indexing. Don't Optimize For It Google Algorithm Discussions 0
NevenaIvanova Bus Stop Names Update NAP, Categories, Dashboard Data 2
H Updating website and urls are no longer .aspx Organic SEO 2
NickB-Tampa URL is updated in Google My Business but doesn't show up correctly in maps or on Bright Local Local Search 2
djbaxter Google Updates Search Quality Raters Guidelines Google News: Important Changes & Features 0
Igor GMB Virtual care link auto updates to wrong URL Google My Business & Google Maps 5
djbaxter Forum updated to Xenforo 2.2.1 Forum Software Updates and Technical Issues 0
Colan Nielsen NEW October 2020 Google My Business Insights Update Google My Business & Google Maps 0
A Legal Services Rankings Tanked After Potential Update - Solutions? What Did You Do? Organic SEO 2
djbaxter Security update Forum Software Updates and Technical Issues 3
freerunr Verbiage in business profile showing when hours on GMB were updated Google My Business & Google Maps 8
JoyHawkins Ranking Updates - August 13, 2020 Google Algorithm Discussions 2
djbaxter WordPress 5.5 update breaks plugins: Here’s the fix Websites, Software, and Security 6
hajnasiewicz "Review updates" but nothing to review All Things Google My Business [PRIVATE] (LocalU) 4
djbaxter What SEOs get wrong about Google updates Google Algorithm Discussions 0
bdebelle Review Updates - "Accept all for this Location" resulting in listing suspension Help & Support for Google Local 2
djbaxter How spam reports are used at Google: Manual actions vs. algorithm updates Spam on Google 2
diptimayee Google Updated Its "How Search Works" Page Google News: Important Changes & Features 2
A Updating sitelinks in Google search for 404 pages Organic SEO 6
billenross update card Contact Us Messages 1
L GMB Insights Data not Updating Properly Google My Business & Google Maps 2
rickvidallon Google Not Updating Number of Reviews Local Reviews 2
djbaxter New SEO Tool: Was There A Google Update Search Site Organic SEO 0
C Payment Updates Contact Us Messages 1
DorothyCarrico Trending Local Algorithm Update in April 2020? Recycle Bin 0
Hammer If GMB not updating after COVID, re-enter the updates Google My Business & Google Maps 1
Paul Lappage Do you need to have specific User permissions to update the Attributes? Google My Business & Google Maps 2
P Change of Address - Do We Update Citations? Citations 2
Jeffrey Taylor Product carousel not updating products Google My Business & Google Maps 5
L How do I set notifications for Google my Business edits that were not done by us or our clients and how to know what Google updated? Google My Business & Google Maps 2
Norbert Z. Trending Local Algorithm Update in April 2020? Google Algorithm Discussions 77
djbaxter Another option? Update your cancelled or postponed events with Schema Google My Business & Google Maps 0
Ellen How Should We Be Updating GMB Hours Related to COVID-19? Google My Business & Google Maps 6
AndySimpson Keeping Your GMB Listing Accurate & Updated During COVID-19 Pandemic Google My Business & Google Maps 3
djbaxter Webinar: 5 Updates to Google My Business Impacting Digital Marketers Events 0

Similar threads

Login / Register

Already a member?   LOG IN
Not a member yet?   REGISTER

Most UpVoted Answers

LocalU Podcasts

  Promoted Posts

New advertising option: A review of your product or service posted by a Sterling Sky employee. This will also be shared on the Sterling Sky & LSF Twitter accounts, our Facebook group, LinkedIn, and both newsletters. More...
Google Product Exert


Top Bottom