![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 14 months ago
Closed 14 months ago
#63454 closed defect (bug) (invalid)
Aikido security: Backticks (``) in PHP are very dangerous and counter-intuitive
| Reported by: | Websonica | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | General | Version: | 6.7.2 |
| Severity: | normal | Keywords: | |
| Cc: | Focuses: |
Description
Hello WordPress Support Team,
My name is Massimo, and I manage a WordPress installation where I’ve identified a potential security risk in the getID3 library included under wp-includes/ID3/.
The Aikido Security team has pointed out that in PHP the backtick operator () is not a simple quotation mark but functions like shell_exec(), executing its contents as a shell command and returning the output. A minimal example that can lead to Remote Code Execution is as small as:
$_GET[2]
Key Points:
Backticks in PHP execute shell commands and return their output to the script.
If the command string is not thoroughly sanitized, an attacker could execute arbitrary system commands.
The getID3 library (up through version 1.9.21 included in WordPress core) uses backticks within getid3.lib.php, potentially exposing sites to RCE.
I would appreciate your guidance on the following:
What is the current status of this issue in WordPress core and planned for future releases?
Are there official plans to remove or mitigate the use of the backtick operator within the bundled getID3 library?
What solution do you recommend for users to secure their installations against this risk without losing media metadata parsing functionality?
I’m happy to provide further details or staging environment logs if needed. Thank you for your assistance, and I look forward to your response.
Best regards,
The use of backticks within ID3 is intentional. It's important to double check automated code reviews for validity, a cursory glance at the lines of code in question would reveal that all four instance of variables encased in backticks within ID3 are system commands that are intended to be executed.
While we appreciate your interest in the security of WordPress, please be more careful with your reports in the future. This is a public bug tracker and you had to check a checkbox that said "I am not reporting a security issue" when submitting this. Further details can be found here: https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/ .