![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
#35370 closed defect (bug) (invalid)
wp-activate.php use unfilter value in database query
| Reported by: | alifamoorzadeh | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | Login and Registration | Version: | 4.4.1 |
| Severity: | normal | Keywords: | |
| Cc: | Focuses: | multisite |
Description (last modified by )
hello
in file "wp-activate.php" lines:
86: $key = !empty($_GET['key']) ? $_GET['key'] : $_POST['key']; 87: $result = wpmu_activate_signup( $key );
passed user input value to wpmu_activate_signup function without filter then this function use value in db query.
Change History (3)
Note:
See TracTickets
for help on using tickets.
Hello @alifamoorzadeh, thanks for the report.
In
wpmu_activate_signup()the$keyvalue gets escaped in tags/4.4.1/src/wp-includes/ms-functions.php#L955 through the use of$wpdb->prepare()(code ref), means we don't use unfiltered values in the query.Since this report was about a potential security issue please keep this mind: