Wordpree plug-in comments. The Code audit is lax.

Shell2us members visited a website and wordpress system. browser B Disabled javascript and found that the website path in the comment was leaked. Download this plug-in from the wordpress official website plug-in download channel and found many problems! Read down
For details, visit a website, wordpree system, and javascript is disabled in the browser. The website path in the comment is leaked. Download this plug-in from the wordpree plug-in download channel. There are still many problems found. Please refer to the following link.
 
 
 
Access http://www.cnluc.com/when reading the document, the browser cannot use JavaScript
The following results show the truth.
 



 
 
Cause: comments. php
<Script type = "text/javascript" src = "http://s2.pinglun.la/md/pinglun.la.js" charset = "UTF-8"> </script>
 
Question 2:
Directly access this file: cwww.2cto.com omments. php
 
 
 
 
Cause: Row 4
 
$ Pinglunla_seo = get_option ("pinglunla_seo", 0 );
The variable get_option () is not declared.
 
Paste the code of this evil file:
 
<? Php
Include_once (dirname (_ FILE _). "/pinglunla-utils.php ");
 
$ Pinglunla_seo = get_option ("pinglunla_seo", 0 );
$ Webpage_url = "http: //". PLL_URL. "/comment_box/plugin/get_comments? Url = ". urlencode (pinglunla_cur_page_url ());
 
?>
<! -- Pll Begin -->
<Div id = "pinglunla_here">
<? Php
If ($ pinglunla_seo = 1 ){
Echo file_get_contents ($ webpage_url );
}
?>
</Div>
<A href = "http://pinglun.la/" id = "logo-pinglunla"> comments </a> <script type = "text/javascript" src = "http://s2.pinglun.la/md/pinglun.la.js" charset = "UTF-8 "> </script>
<! -- Pll End -->
 
Third problem: index. php under the source sinaweibo folder
 
 
 
 
<? Php
Session_start ();
 
Include_once ('config. php ');
Include_once ('saetv2. ex. class. php ');
 
No saetv2.ex. class. php exists in the folder, but there is a saetv2.php
 
Post a winning website:
Http://www.cnluc.com/wp-content/plugins/pinglunla/readme.txt
Http://www.cnluc.com/wp-content/plugins/pinglunla/comments.php
Http://www.cnluc.com/wp-content/plugins/pinglunla/sinaweibo/
Http://www.iamle.com/wp-content/plugins/pinglunla/readme.txt
 
Program:
Http://downloads.wordpress.org/plugin/pinglunla.zip


Solution:

Third-party program development in China, hope to pay attention to security issues !!
 
Author shell2us