News for hackers. Stuff that matters.

A comment on Passwords Reset (Wordpress Plugins Hacked).

Re:Passwords Reset (Wordpress Plugins Hacked) by ck2 on Tuesday June 21, 2011 @10:11PM (#2681339)
This is the timeline I see from when it happened?

http://plugins.trac.wordpress.org/timeline?from=06%2F21%2F11...

http://pastebin.com/raw.php?i=G06rbb5a

Actually, maybe that is the reversion log, yeah it is.

Trying to find what they did:

http://plugins.trac.wordpress.org/changeset?old_path=%2Fw3-t...

[ Parent | on HN ]
Re:Passwords Reset (Wordpress Plugins Hacked) by qixxiq on Tuesday June 21, 2011 @11:21PM (#2681550)
The diff is at: http://plugins.trac.wordpress.org/changeset?reponame=&ol...

PHP's assert function ridiculously runs eval() on the code too, so to use their backdoor they just include code as their HTTP_REFERER.

[ Parent | on HN ]
Re:Passwords Reset (Wordpress Plugins Hacked) by PleaseStand on Wednesday June 22, 2011 @12:17AM (#2681695)
The backdoors in the two other plugins mentioned:

http://plugins.trac.wordpress.org/changeset/399276

http://plugins.trac.wordpress.org/changeset/399286

[ Parent | on HN ]