possible security risk using include function to render images!
-
…/wp-content/plugins/sendpress/classes/public-views/class-sendpress-public-view-open.php
In this file you have replaced this improper technique:
//include(SENDPRESS_PATH . 'img/clear.gif');
with code that uses the file_get_contents function to output your image content safely, without the possible execution of PHP code.However, in this other file:
…/wp-content/plugins/sendpress/inc/pages/default-public.php
this code:
include(SENDPRESS_PATH. '/im/clear.gif');
Is still active and could be used by hackers to gain control over a users site.It is unfortunately fairly common, as hacks go, to be able to upload image files using vulnerabilities in older versions of timthumb, revslider, gavityforms, and other such code that allows for uploading. These uploaded images can contain PHP code that would be uselessly ineffective a hacker unless it is called by an include function as you have done in this plugin. You should never render the contents of an image file with the include function which is intended to execute PHP code within the referenced file. Instead you should use passthru or another function, like the technique you used with the file_get_contents function, to render the content of those files without PHP interpretation/execution.
I hope you can act on this quickly and release a fix for this vulnerability in your next update.
Aloha, Eli
- The topic ‘possible security risk using include function to render images!’ is closed to new replies.
