Skip to main content

WordPress Common Issue Notes

 WordPress:


/wp-content/plugins/sfwd-lms/wpml-config.xml


/wp-content/plugins/omni-secure-files/plupload/examples/upload.php


/wp-content/plugins/contus-hd-flv-player/uploadVideo.php


wp-json/th/v1/user_generation


/wp-admin/admin-ajax.php?do_reset_wordpress=1



Wordpress xmlrpc.php -common vulnerabilites & how to exploit them


https://medium.com/@the.bilal.rizwan/wordpress-xmlrpc-php-common-vulnerabilites-how-to-exploit-them-d8d3c8600b32

Comments

Post a Comment

Popular posts from this blog

Electron JS Security Checklist

Electron Js Security Checklist Disable nodeIntegration for untrusted origins/Do-not Enable Node-Integration Risk  If enabled, nodeIntegration allows JavaScript to leverage Node.js primitives and modules. This could lead to full remote system compromise if you are rendering untrusted content. Auditing nodeIntegration and nodeIntegrationInWorker are boolean options that can be used to determine whether node integration is enabled.  Auditing For BrowserWindow, default is true. If the option is not present, or is set to true/1, nodeIntegration is enabled as in the following examples:  mainWindow = new BrowserWindow({ "webPreferences": { "nodeIntegration": true, “nodeIntegrationInWorker": 1 } });  Or simply:  mainWindow = new BrowserWindow() For webview tag, default is false.  When this attribute is present, the guest page in webview will have node integration: When sanbox is enabled (see below), nodeintegration is disabled. Please note ...
Post a Comment
Read more

External Entity Entity Injection [XXE]

External Entity Entity Injection  [XXE] Extensible markup language was designed for for desktop publishing & now it is widely being used for data exchange It is a mark up language similar to HTML XML is is typically used   instead of HTML when data must be sent from one application to another (Data Interchange) I.e it acts as middleware [JSON,XML are few examples] Attackers can exploit how an application parses extensible mark up language by taking advantage of an XXE vulnerability. More specifically it involves exploiting how the application processes the inclusion of external entities in it’s input. Attacker can use XXE to extract information from a server or to call on a malicious server. Attacker can exploit vulnerable XML process if they can upload XML or include hostile content in an XML document, exploiting vulnerable code, dependencies & integrations, these flaws can be used to extract information , execute a remote request to a malicious server , scan internal...
Post a Comment
Read more