Wordpress Exploit

This is what my blog looks like:

$charset = $_POST['charset'];

if(strlen($charset) > 50)
die;

// These three are stripslashed here so that they can be properly escaped after

Quote:

---

Originally Posted by Snak3

@nux
can you show where exactly in wp-trackback.php have we to paste the following code as mentioned by you in your blog post :

Code:

---

if(strlen($charset) > 50)
die;

---

I understand line 47 but to be precise
I mean, before what and after what piece of code should it come/appear.

---

Should we just remove the trackback.php file from the wordpress folder? Or rename it so its not usable until a full patch is released?

The code I showed you will fix the problem. I've tested it myself.

Quote:

---

Originally Posted by nux

This is what my blog looks like:

$charset = $_POST['charset'];

if(strlen($charset) > 50)
die;

// These three are stripslashed here so that they can be properly escaped after

---

Thnx a bunch, done on my WP blog :thumbsup:

Wordpress has released an update, 2.8.5 which fixes this issue.

just download and installed 2.8.5

Thanks for the heads up :)