Qhov teeb meem tseem ceeb hauv wpDiscuz WordPress plugin, uas muaj 80 txhiab kev teeb tsa

Hauv WordPress plugin wpDiscuz, uas tau nruab rau ntau tshaj 80 txhiab qhov chaw, txheeb xyuas ib tug txaus ntshai vulnerability uas tso cai rau koj mus upload tej ntaub ntawv mus rau lub server yam tsis muaj authentication. Koj tseem tuaj yeem xa cov ntaub ntawv PHP thiab muaj koj cov lej ua tiav ntawm lub server. Qhov teeb meem cuam tshuam rau versions ntawm 7.0.0 rau 7.0.4 suav nrog. Qhov tsis zoo tau raug kho hauv kev tso tawm 7.0.5.

Lub wpDiscuz plugin muab lub peev xwm los siv AJAX rau dynamically tshaj tawm cov lus tsis muaj reloading nplooj ntawv. Qhov tsis zoo yog vim muaj qhov tsis txaus ntseeg hauv cov ntaub ntawv upload hom kev kuaj xyuas code siv los txuas cov duab rau cov lus pom. Txhawm rau txwv kev thauj khoom ntawm cov ntaub ntawv tsis txaus ntseeg, muaj nuj nqi rau kev txiav txim siab MIME hom los ntawm cov ntsiab lus raug hu, uas yooj yim rau kev hla kev thauj cov ntaub ntawv PHP. Cov ntaub ntawv txuas ntxiv tsis txwv. Piv txwv li, koj tuaj yeem thauj cov ntaub ntawv myphpfile.php, ua ntej qhia qhov sib lawv liag 89 50 4E 47 0D 0A 1A 0A, txheeb xyuas cov duab PNG, thiab tom qab ntawd muab qhov thaiv "

Tau qhov twg los: opennet.ru