garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Addition of an AUTHBYPASS type for plugins that will operate without a valid WordPress session and/or adequate privilege, creating a vulnerability due to its functionality. Also, added a portable-phpMyAdmin vulnerability to the plugin vulnerability listing utilizing the aforementioned new type.

Browse Source
This commit is contained in:
Mark Stanislav
2012-12-13 14:07:22 -05:00
parent 19bcc9263c
commit 56e96dc97b
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
data/plugin_vulns.xml
View File

@@ -18,7 +18,7 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
ryandewhurst at gmail
This file contains vulnerabilities associated with WordPress plugins.
TYPE = ["SQLI", "MULTI", "REDIRECT", "RCE", "RFI", "LFI", "UPLOAD", "UNKNOWN", "XSS", "CSRF"]
TYPE = ["SQLI", "MULTI", "REDIRECT", "RCE", "RFI", "LFI", "UPLOAD", "UNKNOWN", "XSS", "CSRF", "AUTHBYPASS"]
<plugin name="">
<vulnerability>
@@ -2420,5 +2420,12 @@ File Upload Vulnerability</title>
<type>RCE</type>
</vulnerability>
</plugin>
<plugin name="portable-phpmyadmin">
<vulnerability>
<title>portable-phpMyAdmin &lt; 1.3.1 Authentication Bypass</title>
<reference>http://www.exploit-db.com/exploits/23356</reference>
<type>AUTHBYPASS</type>
</vulnerability>
</plugin>
</vulnerabilities>