November 2018 Summaries

The phpBB3 forum software contains a Phar deserialization vulnerability, which allows authenticated attackers to execute arbitrary PHP code on the server, potentially leading to a full site takeover. The vulnerability exploits the use of image editing software and file system functions in the software's admin control panel. An attacker must first upload a malicious Phar file to the target server, then predict the filename of the file by exploiting weaknesses in the file uploading process. Once the correct path is known, an attacker can trigger the Phar deserialization vulnerability and execute arbitrary PHP code on the server using POP gadgets. The phpBB3 security team has released a patch with version 3.2.4 to address this issue.

A vulnerability exists in WordPress plugins that allows shop managers to delete certain files on the server, leading to a potential takeover of administrator accounts. The issue arises from an unpatched design flaw in how WordPress handles privileges, which can be exploited by deleting specific plugin files or using meta capabilities to bypass security checks. Over 4 million WooCommerce shops are affected, and the vulnerability was reported on Hackerone in August 2018, with a patch released in October of that year. The exploit works because user roles are stored in the database even if the plugin is disabled, allowing shop managers with access to edit customer accounts to take over administrator accounts by updating their passwords or deleting critical files such as `woocommerce.php`.