Rashin lahani a cikin plugins na WordPress tare da shigarwa sama da miliyan

Masu binciken tsaro daga Wordfence da WebARX sun gano lahani masu haɗari da yawa a cikin plugins guda biyar don tsarin sarrafa abun ciki na gidan yanar gizon WordPress, jimlar sama da shigarwa miliyan.

• Varfafawa a cikin plugin GDPR Yarjejeniyar Cookie, wanda yana da fiye da 700 dubu shigarwa. An ƙididdige batun Matsayi Mai tsanani 9 cikin 10 (CVSS). Rashin lahani yana ba wa ingantacciyar mai amfani tare da haƙƙin biyan kuɗi don sharewa ko ɓoye (canza matsayi zuwa daftarin da ba a buga ba) kowane shafi na rukunin yanar gizon, da kuma musanya abubuwan nasu akan shafukan.
  Varfafawa shafe a cikin saki 1.8.3.

• Varfafawa a cikin plugin ThemeGrill Demo Importer, ƙidaya fiye da 200 dubu shigarwa (ainihin hare-hare a kan shafukan da aka rubuta, bayan da farkon wanda kuma bayyanar da bayanai game da rauni, yawan shigarwa ya riga ya ragu zuwa 100 dubu). Rashin lahani yana bawa baƙo mara inganci damar share abubuwan da ke cikin bayanan rukunin yanar gizon kuma ya sake saita bayanan zuwa sabon yanayin shigarwa. Idan akwai mai amfani mai suna admin a cikin ma'ajin bayanai, to raunin kuma yana ba ku damar samun cikakken iko akan rukunin yanar gizon. Rashin lafiyar yana faruwa ne sakamakon gazawar tantance mai amfani da ke ƙoƙarin ba da umarni masu gata ta hanyar rubutun /wp-admin/admin-ajax.php. An gyara matsalar a cikin sigar 1.6.2.
• Varfafawa a cikin plugin ThemeREX Addons, ana amfani da shi akan shafuka dubu 44. An ba da batun matsakaicin matakin 9.8 cikin 10. Rashin lahani yana ba wa mai amfani da ba shi da tabbacin aiwatar da lambar PHP ɗin su akan sabar kuma ya maye gurbin asusun mai gudanar da rukunin yanar gizon ta hanyar aika buƙatu ta musamman ta REST-API.
  An riga an yi rikodin shari'o'in yin amfani da raunin a kan hanyar sadarwa, amma sabuntawa tare da gyara ba a samu ba tukuna. An shawarci masu amfani su cire wannan plugin ɗin da sauri.

• Varfafawa a cikin plugin wpCentral, adadin shigarwa dubu 60. An ba da batun matsananciyar matakin 8.8 daga cikin 10. Rashin lahani yana ba da damar kowane baƙo mai inganci, gami da waɗanda ke da haƙƙin biyan kuɗi, don haɓaka haƙƙinsu ga mai gudanar da rukunin yanar gizon ko samun damar shiga kwamitin kula da wpCentral. An gyara matsalar a cikin sigar 1.5.1.
• Varfafawa a cikin plugin Mai Gina Bayanan Bayani, tare da kusan 65 dubu shigarwa. An ba da batun matakin tsanani na 10 daga cikin 10. Rashin lahani yana ba da damar mai amfani mara izini don ƙirƙirar asusu tare da haƙƙin gudanarwa (filin ɗin yana ba ku damar ƙirƙirar fom ɗin rajista kuma mai amfani zai iya wuce ƙarin filin kawai tare da rawar mai amfani, sanyawa. shi ne matakin admin). An gyara matsalar a cikin sigar 3.1.1.

Bugu da ƙari, ana iya lura da shi ganowa cibiyoyin sadarwa don rarraba plugins na Trojan da jigogi na WordPress. Maharan sun sanya kwafin kwafin plugins ɗin da aka biya a kan shafukan tarihin ƙage, tun da a baya sun haɗa kofa a cikinsu don samun damar shiga nesa da sauke umarni daga uwar garken sarrafawa. Da zarar an kunna, an yi amfani da lambar ɓarna don saka tallace-tallace na ƙeta ko yaudara (misali, gargaɗi game da buƙatar shigar da riga-kafi ko sabunta burauzar ku), da kuma inganta injin bincike don haɓaka rukunin yanar gizon da ke rarraba abubuwan plugins. Dangane da bayanan farko, sama da shafuka dubu 20 sun lalace ta amfani da waɗannan plugins. Daga cikin wadanda abin ya shafa sun hada da wani dandali na hakar ma'adinai, wani kamfani na kasuwanci, banki, manyan kamfanoni da dama, mai samar da hanyoyin biyan kudi ta hanyar amfani da katunan bashi, kamfanonin IT, da dai sauransu.

source: budenet.ru