[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability
We've been seeing you keep mistakenly assuming RFI for constant variables.
For next releases of your great bug hunting journey, please note:
1. Constant variables are usually written Capital letter such as
ABSPATH, DB_USER, DB_PASSWORD, DB_HOST
2. Programmers define them in config file in advance/earlier with
define function like define( ABSPATH, ...) , define(DB_USER,...)
If this finding is automatically invoked by your own written audit
scripts, please fix it.
No offense, actually. We appreciate it.
On Fri, Jul 31, 2009 at 2:09 AM, Francesco
> On Thu, 2009-07-30 at 21:49 +0430, Cru3l.b0y wrote:
>> Hi Dear,
>> I found a new bug. please publish it.
>> thank you
>> best regards
> ABSPATH is a defined variable. You can't change its value by using a
> query string.