News for hackers. Stuff that matters.

A comment on WordPress base configuration files on GitHub. Parent comment

Re:WordPress base configuration files on GitHub by JosephRedfern on Monday August 17, 2015 @09:52AM (#10072933)
How can you tell that? Just because it specifies "localhost" doesn't necessarily mean it's a dev box.
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by ishener on Monday August 17, 2015 @10:01AM (#10072984)
Exactly. Also remember that on many many wordpress servers you also have phpMyAdmin. You can use the username + password to login, and you'll get access even when it's restricted to localhost.
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by 0x0 on Monday August 17, 2015 @10:19AM (#10073101)
It's pretty scary to have phpMyAdmin public facing. IIRC some older versions of mysql-server even had a bug where it'd let you in with a random password in 1/256 chance!
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by leni536 on Monday August 17, 2015 @10:43AM (#10073286)
It should be really bad, since phpmyadmin get attempts are the most frequent on my home webserver and I don't even have it installed. Maybe older vulnerable versions are still around though.
[ Parent | on HN ]