漏洞概要 关注数(24) 关注此漏洞
>
漏洞详情
披露状态：
2012-07-13： 积极联系厂商并且等待厂商认领中，细节不对外公开
2012-07-13： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
通过文件错误暴目录.
详细说明：
1337上看到的,
缺陷文件:
http://Localhost/{Path}/wp-includes/registration-functions.php
关键代码 :
---->
<?php
/**
* Deprecated. No longer needed.
*
* @package WordPress
*/
_deprecated_file( basename(__FILE__), '2.1', null, __( 'This file no longer needs to be included.' ) );
?>
----->
漏洞证明：
随便测试了几个大牛. 基本都中枪.
http://blog.gentilkiwi.com/wp-includes/registration-functions.php?nulled=adm1n.org
http://www.0x50sec.org/wp-includes/registration-functions.php?nulled=adm1n.org
http://www.dis9.com/wp-includes/registration-functions.php?nulled=adm1n.org
http://madman.in/wp-includes/registration-functions.php?nulled=adm1n.org
http://www.tzsec.net/wp-includes/registration-functions.php?nulled=adm1n.org
http://www.secreader.com/wp-includes/registration-functions.php?nulled=adm1n.org
修复方案：
暂无.
版权声明：转载请注明来源 idontknowwhy@乌云
>
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝