[Plugin: Ninja Announcements] SQL injection hole

  • Resolved Dave Konopka

    (@dkonopka)


    15 years ago

    The way that the plugin handles deletes/deactivations/activations has two pretty major security issues. First of all, it allows anyone to fire off deletion/deactivation/activation without being logged in. But even worse than that the way the sql calls are being made leave it wide open to a SQL injection attack. So anyone could wipe out or insert garbage into a WordPress site with this plugin loaded. I’d be happy to chat more about this if you need more specifics.

    http://ww.wp.xz.cn/extend/plugins/ninja-announcements/

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author Kevin Stover

    (@kstover)

    15 years ago

    Hey dk,

    Thanks for bringing this up, I’ve been working on a fix for the past couple of weeks, but I don’t have anything ready to commit yet. This plugin was made before I did enough research about ajax calls within WordPress. The new version will use the built-in WordPress ajax functionality and better sql preparing to curtail those issues.

    -Kevin

    Plugin Author Kevin Stover

    (@kstover)

    15 years ago

    Just updated the plugin to version 1.3. This version fixes the security holes that dkonopka mentioned. Please update to it asap.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘[Plugin: Ninja Announcements] SQL injection hole’ is closed to new replies.