Skip to content

Instantly share code, notes, and snippets.

View kharissulistiyo's full-sized avatar
🏠
Working from home

Kharis Sulistiyono kharissulistiyo

🏠
Working from home
27 followers · 57 following
View GitHub Profile
@kharissulistiyo
kharissulistiyo / patch-code-sample-sensitive-data-exposure.php
Created November 19, 2024 09:07
Patch code sample: Sensitive Data Exposure vulnerability
<?php
register_rest_route($this->namespace . '/v1', '/newsletter', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => array($this, 'get_subscribers_callback'),
'args' => array(
'group_id' => array(
'required' => false,
)
@kharissulistiyo
kharissulistiyo / bad-code-sample-sensitive-data-exposure.php
Created November 19, 2024 09:04
Bad code sample: Sensitive Data Exposure vulnerability
<?php
register_rest_route($this->namespace . '/v1', '/newsletter', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => array($this, 'get_subscribers_callback'),
'args' => array(
'group_id' => array(
'required' => false,
)
@kharissulistiyo
kharissulistiyo / patch-code-sample-privilege-escalation.php
Created November 18, 2024 22:52
Patch PHP Privilege Escalation vulnerability
<?php
if (!isset($phone_number) && isset($email) && filter_var($email, FILTER_VALIDATE_EMAIL)) {
$ID = email_exists($email);
}
$current_user_id = get_current_user_id();
if($current_user_id!==$ID){
die ('user id not same!');
}
@kharissulistiyo
kharissulistiyo / bad-code-sample-privilege-escalation.php
Created November 18, 2024 22:50
Bad PHP code sample: Privilege Escalation vulnerability
<?php
if (!isset($phone_number) && isset($email) && filter_var($email, FILTER_VALIDATE_EMAIL)) {
$ID = email_exists($email);
}
$user = get_user_by('ID', $ID);
$password = sanitize_text_field($_GET['password']);
if ($user) {
@kharissulistiyo
kharissulistiyo / patch-code-sample-arbitrary-file-deletion.php
Last active November 18, 2024 09:57
Patch PHP Arbitrary File Deletion vulnerability
<?php
/**
* Crop the avatar.
*
* @since 2.3.0
*
* @see BP_Attachment::crop for the list of parameters
*
* @param array $args Array of arguments for the cropping.
@kharissulistiyo
kharissulistiyo / bad-code-sample-arbitrary-file-deletion.php
Last active November 18, 2024 09:57
Bad PHP code sample: Arbitrary File Deletion vulnerability
<?php
/**
* Crop the avatar.
*
* @since 2.3.0
*
* @see BP_Attachment::crop for the list of parameters
*
* @param array $args Array of arguments for the cropping.
@kharissulistiyo
kharissulistiyo / patch-code-sample-broken-authentication.php
Created November 17, 2024 12:40
Patch PHP Broken Authentication vulnerability
<?php
public function registration_form( $atts ) {
$atts = shortcode_atts(
[
'role' => '',
], $atts
);
$userrole = $atts['role'];
@kharissulistiyo
kharissulistiyo / bad-code-sample-broken-authentication.php
Created November 17, 2024 12:04
Bad PHP code sample: Broken Authentication vulnerability
<?php
public function registration_form( $atts ) {
$atts = shortcode_atts(
[
'role' => '',
], $atts
);
$userrole = $atts['role'];
@kharissulistiyo
kharissulistiyo / patch-code-sample-remote-code-execution.php
Created November 17, 2024 02:29
PHP realpath(): Patch Remote Code Execution vulnerability
<?php
if( isset( $_POST[ 'action' ] ) && $_POST[ 'action' ] == 'scupdates' ) {
if( isset( $_POST[ 'wp_cache_location' ] ) && $_POST[ 'wp_cache_location' ] != '' ) {
$dir = realpath( trailingslashit( dirname( $_POST[ 'wp_cache_location' ] ) ) );
if ( $dir === realpath( '.' ) || false === $dir ) {
$dir = WP_CONTENT_DIR . '/cache/';
} else {
$dir = trailingslashit( $dir ) . trailingslashit(wpsc_deep_replace( array( '..', '\\' ), basename( $_POST[ 'wp_cache_location' ] ) ) );
}
@kharissulistiyo
kharissulistiyo / bad-code-sample-remote-code-execution.php
Created November 17, 2024 02:06
Bad PHP code sample: Remote Code Execution (RCE) vulnerability
<?php
if( isset( $_POST[ 'action' ] ) && $_POST[ 'action' ] == 'scupdates' ) {
if( isset( $_POST[ 'wp_cache_location' ] ) && $_POST[ 'wp_cache_location' ] != '' ) {
$dir = realpath( trailingslashit( dirname( $_POST[ 'wp_cache_location' ] ) ) );
if ( $dir == false ) {
$dir = WP_CONTENT_DIR . '/cache/';
} else {
$dir = trailingslashit( $dir ) . trailingslashit(wpsc_deep_replace( array( '..', '\\' ), basename( $_POST[ 'wp_cache_location' ] ) ) );
}