Does anyone know if Wordpress is vulnerable to HTTP parameter pollution?
I have been receiving some notifications from Acunetix report about it reporting this issue.
thanks.
4
-
1can you give please less details, I am overwhelmed ;). what is parameter pollution? What does Acunetix exactly report?– Mark KaplunMay 13, 2016 at 22:24
-
If you don't know why you botter to reply with useless infomation, anyway here it is for you to learn a bit more By exploiting these effects, an attacker may be able to bypass input validation, trigger application errors or modify internal variables values. As HTTP Parameter Pollution (in short HPP) affects a building block of all web technologies, server and client side attacks exist. EDIT: owasp.org/index.php/…– osaki3b3May 13, 2016 at 22:49
-
1-1 for "If you don't know why you botter to reply with useless infomation". Why expect others to research for you?– BillKMay 14, 2016 at 0:23
-
1@osaki3b3, you should edit your question to include that info. people here are not a security researchers and not familiar with all the relevant buzzwords. So that was an interesting read, but it is still not clear what is it that that Acunetix reports that raised your question? Obviously this kind of attack, as any other kind of attack based on sending a specially crafted user input can be attempted against wordpress site.– Mark KaplunMay 14, 2016 at 4:21
Add a comment
|
1 Answer
This really wouldn't have anything to do with WordPress intrinsically. It would be related to some plugin or code that passes values based on post data or anything that can request back-end HTTP to another application. The problem is you are open for XSS and SQL injection.
Do you have user input fields i.e. POST data that is passed without encoding the URL properly? Any point of user input should be sanitized.
Check out http://www.w3schools.com/tags/ref_urlencode.asp for reference.
I found an example of this here - https://stackoverflow.com/questions/19809142/http-parameter-pollution
