News for hackers. Stuff that matters.

A comment on Panama Papers: Email Hackable via WordPress, Docs Hackable via Drupal. Parent comment

Re:Panama Papers: Email Hackable via WordPress, Docs Hackabl... by danso on Friday April 08, 2016 @08:53PM (#11459318)
Ah that's the obvious detail I was looking for. I guess my other question would be...is there any reason why a front-end site like WordPress has to have mailing functionality built-in? I mean I know WP is more than just a blogging platform...but...I'm trying to think of a situation in which a company has so many clients and client interactions that it's just convenient to bake email functionality into the homepage/news site...but that it's apparently not worth the effort to invest in a proper CRM? I know they're a law firm and not a tech company and CMS architecture is not their specialty, but they're not also running a site to manage the church bake sale. What kind of IT people could such a wealthy firm hire that wouldn't have enough experience to worry about this kind of thing?
[ Parent | on HN ]
Re:Panama Papers: Email Hackable via WordPress, Docs Hackabl... by mediumdeviation on Friday April 08, 2016 @08:57PM (#11459329)
A CMS would need to send email so that it can reset passwords, just as an example. Again, as the parent has said, the failing here is not that the CMS is provided with email credentials - that's very common for all but the simplest CMS, but that it didn't separate and limit the accounts properly
[ Parent | on HN ]
Re:Panama Papers: Email Hackable via WordPress, Docs Hackabl... by danso on Friday April 08, 2016 @09:06PM (#11459359)
Right, but...in this specific situation, their WordPress homepage doesn't appear to be the client-serving portal...That's what Drupal is for:

https://portal.mossfon.com/

Drupal was apparently where the CRM was handled, including the posting of documents and so forth. The use-case you mention seems to be something that should be handled by the Drupal site.

Though I guess this speculation is just moot. The severity of the Drupal flaw would seemingly allow access to whatever Drupal uses to talk to the email server. That the WordPress server used the same email server and had the same access is just coincidence, another example of careless IT by MF, not that MF was necessarily using WordPress as a client-serving site.

[ Parent | on HN ]
Re:Panama Papers: Email Hackable via WordPress, Docs Hackabl... by icebraining on Saturday April 09, 2016 @04:12AM (#11460456)
The Wordpress blog editors would need to reset their own password occasionally.
[ Parent | on HN ]