In a plugin vulnerability exists! How to fix it?
-
Found that under the guise of a photo plugin allows you to upload anything. I just took the first available php file and … he was on the server !!! As far as I understand it through this hole in the vulnerability can hack site. ??
How to check the image to download and it is desirable to overwrite? Ie to not only check the image information to appropriate extensions of the “mime” fields, but also dubbed extension? The meaning of this is that if an attacker will bypass all security element with the extension and instead load the image file with malicious code, due to the fact that the file is saved (or rather overwritten) with clearly specified extension, he can not run it, because PHP interpreter will read this file image.
Found on the subject are many examples, but something you can not embed it all in the plugin, so that worked.
- The topic ‘In a plugin vulnerability exists! How to fix it?’ is closed to new replies.
