Kutsika kwa database mu UpdraftPlus WordPress add-on ndi 3 miliyoni kukhazikitsa

Chiwopsezo chowopsa (CVE-3-2022) chadziwika mu UpdraftPlus WordPress add-on, yomwe ili ndi zowonjezera zopitilira 0633 miliyoni, zomwe zimalola wogwiritsa ntchito chipani chachitatu kutsitsa nkhokwe ya tsambalo, lomwe, kuwonjezera pa zomwe zili, zili ndi magawo a ogwiritsa ntchito onse ndi mawu achinsinsi. Nkhaniyi yathetsedwa pakumasulidwa 1.22.3 ndi 2.22.3, zomwe zimalimbikitsidwa kuti ogwiritsa ntchito onse a UpdraftPlus ayike mwamsanga.

UpdraftPlus imatchulidwa ngati chowonjezera chodziwika kwambiri popanga zosunga zobwezeretsera zamasamba omwe akuyenda pa nsanja ya WordPress. Chifukwa cha kuwunika kolakwika kwa ufulu wopezeka, chowonjezeracho chinalola kutsitsa kopi yosunga zosunga zobwezeretsera zatsambalo ndi nkhokwe yolumikizidwa osati kwa oyang'anira okha, komanso kwa aliyense wolembetsa patsamba, mwachitsanzo, ndi olembetsa.

Kuyika zosunga zobwezeretsera mu UpdraftPlus, chizindikiritso chimagwiritsidwa ntchito chomwe chimapangidwa kutengera nthawi yomwe zosunga zobwezeretsera zidapangidwa komanso kutsata mosasintha (nonce). Vuto ndiloti chifukwa cha kusowa kwa macheke oyenerera mu WordPress heartbeat handler, pogwiritsa ntchito pempho lopangidwa mwapadera, wogwiritsa ntchito aliyense angapeze zambiri zokhudza zosunga zobwezeretsera zaposachedwa, zomwe zimaphatikizapo zambiri zokhudza nthawi ndi zochitika zomwe zimagwirizanitsidwa mwachisawawa.

Kenako, kutengera zomwe mwalandira, mutha kupanga chizindikiritso ndikutsitsa kopi yosunga zosunga zobwezeretsera pogwiritsa ntchito njira yotsitsa ndi imelo. Ntchito ya maybe_download_backup_from_email yomwe imagwiritsidwa ntchito mu njirayi imafuna kupeza tsamba la options-general.php, lomwe limapezeka kwa woyang'anira yekha. Komabe, wowukira atha kulumpha lamuloli powononga $pagenow kusintha komwe kumagwiritsidwa ntchito mucheke ndi kutumiza pempho kudzera patsamba lautumiki lomwe limalola ogwiritsa ntchito opanda mwayi mwayi wofikira. Mwachitsanzo, mutha kulumikizana ndi tsambalo kuti mutumize uthenga kwa woyang'anira potumiza pempho mu mawonekedwe "wp-admin/admin-post.php/%0A/wp-admin/options-general.php?page=updraftplus ”.

Source: opennet.ru