|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 While in no way do I wish to take away from the value of your finding these problems (and providing such a convenient fix), your claims of having written "the first weblog worm" seem incorrect. See http://it.slashdot.org/it/05/10/14/126233.shtml?tid=172&tid=95&tid=220 for the entertaining story of one (presumably lonely) hacker, myspace.com, and the powers of exponential propagation. My favorite part is "/was spreading at a rate of 1,000 users every few seconds before MySpace shut down its site/". - - Neil PS: Have you reported these problems directly to Wordpress? It might be nice if they could get an official patch out. I'm sure that they have a fairly complete list of users and hence can get these problems cleaned up in more sites in less time than this email will. mybeni websecurity wrote: > Hey Guys, this another one of my FD Releases! > > I found several critical Wordpress 2.2.1 Vulnerabilities, in detail > explained here: > > http://mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm/ > > Plus I made - by using the Exploits I created during my research - the > first weblog worm, but a "friendly" one: It guides people coming from > their /wp-admin/ Wordpress Control Panel through the Patching process of > 3 critical Security Vulnerabilities (XSS, Pers. XSS, SQLInjection), all > based on _javascript_ and by using the Vulnerabilities. All you need is to > post a comment with a link to my blog > http://mybeni.rootzilla.de/mybeNi/ to your own one and then, all you > have to do is to click on the link e.g. in the comment Moderation area. > My Server sees that you're Referring from an Admin Panel and the Worm > Thingy will show up. Pictures and more are provided here: > http://mybeni.rootzilla.de/mybeNi/2007/this_is_the_first_weblog_xss_worm/ > > > cheers, > > Benjamin Flesch > mybeNi websecurity > the 17yo who hacked google. > > ---------------------------------------------------------------------------- > Join us on IRC: irc.freenode.net #webappsec > > Have a question? Search The Web Security Mailing List Archives: > http://www.webappsec.org/lists/websecurity/ > > Subscribe via RSS: > http://www.webappsec.org/rss/websecurity.rss [RSS Feed] > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Signed by GnuPG by Neil Smithline Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGsIsjLO8auUXcF7oRAo5kAJ4zQYFJphRoYJE4q4sRwPcbVDRHlgCgtmCY 0tM5lXZC0fIj5wXRbqEe8o4= =/++T -----END PGP SIGNATURE----- |
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
