{"id":90583,"date":"2020-08-03T01:42:25","date_gmt":"2020-08-02T23:42:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok"},"modified":"2020-08-03T01:42:25","modified_gmt":"2020-08-02T23:42:25","slug":"kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","title":{"rendered":"Vuln\u00e9rabilit\u00e9 critique dans le plugin WordPress wpDiscuz, qui compte 80 000 installations","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dans le plugin WordPress <noindex><a rel=\"nofollow\" href=\"https:\/\/wordpress.org\/plugins\/wpdiscuz\/\">wpDiscuz<\/a><\/noindex>, qui est install\u00e9 sur plus de 80 000 sites, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.wordfence.com\/blog\/2020\/07\/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin\/\">une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e<\/a><\/noindex> une vuln\u00e9rabilit\u00e9 dangereuse permettant de t\u00e9l\u00e9charger n'importe quel fichier sur le serveur sans authentification. Cela inclut la possibilit\u00e9 de t\u00e9l\u00e9charger des fichiers PHP et d'ex\u00e9cuter son propre code sur le serveur. Les versions vuln\u00e9rables vont de 7.0.0 \u00e0 7.0.4 inclus. La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans la version 7.0.5.<\/p>\n<p>Le plugin wpDiscuz permet d'utiliser AJAX pour envoyer des commentaires de mani\u00e8re dynamique sans recharger la page. La vuln\u00e9rabilit\u00e9 est due \u00e0 un d\u00e9faut dans le code de v\u00e9rification des types de fichiers t\u00e9l\u00e9charg\u00e9s, utilis\u00e9 pour attacher des images aux commentaires. Pour limiter le t\u00e9l\u00e9chargement de fichiers arbitraires, la fonction de d\u00e9termination du type MIME par le contenu \u00e9tait appel\u00e9e, ce qui pouvait \u00eatre facilement contourn\u00e9 pour t\u00e9l\u00e9charger des fichiers PHP. L'extension de fichier n'\u00e9tait pas restreinte. Par exemple, il \u00e9tait possible de t\u00e9l\u00e9charger un fichier myphpfile.php en indiquant d'abord la s\u00e9quence 89 50 4E 47 0D 0A 1A 0A, identifiant les images PNG, suivie d'un bloc &#171;&lt;?php&#187; contenant du code PHP.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53477\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043b\u044e\u0431\u043e\u0439 \u0444\u0430\u0439\u043b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c PHP-\u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 7.0.0 \u043f\u043e 7.0.4 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 7.0.5. \u041f\u043b\u0430\u0433\u0438\u043d wpDiscuz \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AJAX \u0434\u043b\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-90583","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-02T23:42:25+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-02T23:42:25+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 critique dans le plugin WordPress wpDiscuz, avec 80 000 installations | ProHoster","description":"Dans le plugin WordPress wpDiscuz, qui est install\u00e9 sur plus de 80 000 sites,","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432,","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-02T23:42:25+00:00","article:modified_time":"2020-08-02T23:42:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90583","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:46:55","updated":"2022-09-27 17:43:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/90583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=90583"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/90583\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=90583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=90583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=90583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}