[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability

Hi Cru3l.b0y

We've been seeing you keep mistakenly assuming RFI for constant variables.
For next releases of your great bug hunting journey, please note:

1. Constant variables are usually written Capital letter such as
ABSPATH, DB_USER, DB_PASSWORD, DB_HOST
2. Programmers define them in config file in advance/earlier with
define function like define( ABSPATH, ...) , define(DB_USER,...)

If this finding is automatically invoked by your own written audit
scripts, please fix it.

No offense, actually. We appreciate it.


On Fri, Jul 31, 2009 at 2:09 AM, Francesco
Laurita<francesco@xxxxxxxxxxxxxxxxxxxxxx> wrote:
> On Thu, 2009-07-30 at 21:49 +0430, Cru3l.b0y wrote:
>> Hi Dear,
>> I found a new bug. please publish it.
>> thank you
>> best regards
>
> Bogus.
> ABSPATH is a defined variable. You can't change its value by using a
> query string.
>
> Regards
>
>