WordPress 2.8.3 Remote admin reset password

Re:WordPress 2.8.3 Remote admin reset password by jgrahamc on Tuesday August 11, 2009 @11:14AM (#755374)

How does it actually work? It looks like reset_password needs to get a valid key to be able to get the user's details from the database.

  	$user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users
            WHERE user_activation_key = %s", $key));

How does that line of code retrieve a valid $user? I looked at the bug fix which filters out the $key being an array, and that will prevent you from passing an array, but I don't see how the array gets you over the hurdle above.

[ Parent | on HN ]

Re:WordPress 2.8.3 Remote admin reset password by mdasen on Tuesday August 11, 2009 @11:26AM (#755413)

I'm guessing that WordPress has user_activation_key set to '' (empty string) when the user hasn't requested a password reset or similar email-confirmed operation. So, it checks to see if it is empty, it isn't and so it checks to find the user(s) who have empty user_activation_key values. It's using a get_row() method which indicates that it will just return one and not an array which would have caused a type error.

UPDATE: yes, user_activation_key is an empty string when WordPress hasn't received a request from a user to do something that would require it to be set.

[ Parent | on HN ]

Re:WordPress 2.8.3 Remote admin reset password by jgrahamc on Tuesday August 11, 2009 @11:58AM (#755506)

Nasty stuff. I notice from the code that once user_activation_key has been set it doesn't get reset. So this vulnerability will not work for someone who has previously asked for password reset.

[ Parent | on HN ]