{"id":23177,"date":"2020-12-09T09:53:04","date_gmt":"2020-12-09T01:53:04","guid":{"rendered":"https:\/\/web.mwwsb.com.my\/pjci\/?post_type=kb&#038;p=23177"},"modified":"2023-01-18T11:36:10","modified_gmt":"2023-01-18T03:36:10","slug":"security-update-serendipity-1-7-8-update","status":"publish","type":"kb","link":"https:\/\/www.casbay.com\/guide\/kb\/security-update-serendipity-1-7-8-update","title":{"rendered":"SECURITY UPDATE: Serendipity 1.7.8 Update"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"23177\" class=\"elementor elementor-23177\" data-elementor-post-type=\"kb\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-797b7b8 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"797b7b8\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-820b13a\" data-id=\"820b13a\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7f5255c elementor-widget elementor-widget-heading\" data-id=\"7f5255c\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-medium\">SECURITY UPDATE: Serendipity 1.7.8 Update\n<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0e3fea6 elementor-widget elementor-widget-image\" data-id=\"0e3fea6\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"275\" height=\"183\" src=\"https:\/\/www.casbay.com\/guide\/wp-content\/uploads\/2021\/06\/security-update.jpg\" class=\"attachment-large size-large wp-image-37589\" alt=\"security protection-serendipity\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f210e2b elementor-widget elementor-widget-text-editor\" data-id=\"f210e2b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The Serendipity vulnerability was found by High-Tech Bridge SA Security Research Lab. Attackers often use the vulnerability to perform SQL injection attacks.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-967d83d elementor-widget elementor-widget-heading\" data-id=\"967d83d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-medium\">So, here is the issue happen in Serebdupity 1.7.8 Update:<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aa883be elementor-widget elementor-widget-heading\" data-id=\"aa883be\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">SQL injection in Serendipity<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e089c6f elementor-widget elementor-widget-text-editor\" data-id=\"e089c6f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Before the 1.1 input is used in a SQL query, it is first passed to comment.php via the \u201curl\u201d GET parameter which is not sanitized properly. Therefore, it allows individuals to manipulate SQL queries. Moreover, they can carry out manipulation by injecting arbitrary SQL code.<\/p><p>However, you can refer the following PoC (Proof of Concept) which demonstrates the vulnerability:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-17913f3 elementor-widget elementor-widget-text-editor\" data-id=\"17913f3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>http:\/\/[host]\/comment.php?<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-760e8ca elementor-widget elementor-widget-text-editor\" data-id=\"760e8ca\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>type=trackback&amp;entry_id=1&amp;url=%27%20OR%20mid%28version%28%29,1,1%29=5%20\u2013%202<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd5019d elementor-widget elementor-widget-text-editor\" data-id=\"fd5019d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Then, successful exploitation of this vulnerability needs that \u201cmagic_quotes_gpc\u201d to be off.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2db106d elementor-widget elementor-widget-heading\" data-id=\"2db106d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Solution:<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-71c0a1e elementor-widget elementor-widget-text-editor\" data-id=\"71c0a1e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Firstly, to solve this issue, we suggest you to upgrade to <a href=\"http:\/\/www.s9y.org\/12.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-wpel-link=\"external\">Serendipity 1.7.8<\/a><\/p><p>Furthermore, if you need more information, please visit :<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0d73400 elementor-widget elementor-widget-text-editor\" data-id=\"0d73400\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"http:\/\/blog.s9y.org\/archives\/241-Serendipity-1.6.2-released.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-wpel-link=\"external\">Serendipity 1.6.2 released<\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9bf2cf1 elementor-widget elementor-widget-text-editor\" data-id=\"9bf2cf1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>and<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d2c9d17 elementor-widget elementor-widget-text-editor\" data-id=\"d2c9d17\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/github.com\/s9y\/Serendipity\/commit\/87153991d06bc18fe4af05f97810487c4a340a92#diff-1\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-wpel-link=\"external\">GitHub of Serendipity<\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-352fda5 elementor-widget elementor-widget-text-editor\" data-id=\"352fda5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>**************************************************************************************************<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-af5fa9d elementor-widget elementor-widget-heading\" data-id=\"af5fa9d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Vulnerability Description:\n<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2c15de8 elementor-widget elementor-widget-text-editor\" data-id=\"2c15de8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The Serendipity back end is prone to a Cross-Site Scripting and SQL-Injection vulnerability.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-07ec5dd elementor-widget elementor-widget-heading\" data-id=\"07ec5dd\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Solution:\n<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a5bf584 elementor-widget elementor-widget-text-editor\" data-id=\"a5bf584\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Firstly, to solve the problem, it is necessary to upgrade to <a href=\"http:\/\/www.s9y.org\/12.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-wpel-link=\"external\">version 1.7.8<\/a>. To upgrade these scripts, go to your Control Panel -&gt; Softaculous -&gt; Installations.<\/p><p>Then, you can update the scripts.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78fac06 elementor-widget elementor-widget-heading\" data-id=\"78fac06\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-medium\">Credits:<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2d00643 elementor-widget elementor-widget-text-editor\" data-id=\"2d00643\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>For your information, the vulnerabilities is found and advisory is written by Stefan Schurtz (KORAMIS Security Team).<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bfeb836 elementor-widget elementor-widget-heading\" data-id=\"bfeb836\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-medium\">Reference:\n<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b3b9cbf elementor-widget elementor-widget-text-editor\" data-id=\"b3b9cbf\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"http:\/\/blog.s9y.org\/archives\/240-Serendipity-1.6.1-released.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-wpel-link=\"external\">Serendipity 1.6.1 released<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-48c691b elementor-widget elementor-widget-text-editor\" data-id=\"48c691b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Now you have just learned the solution to solve the vulnerabilities in Serendipity 1.7.8. After all, if you feel like reading more articles about CMS (Content management System), please visit our <a href=\"https:\/\/www.casbay.com\/guide\/kb\/prevent-spamming-in-wordpresss-comments\">Knowledge Base<\/a>.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>SECURITY UPDATE: Serendipity 1.7.8 Update The Serendipity vulnerability was found by High-Tech Bridge SA Security Research Lab. Attackers often use the vulnerability to perform SQL injection attacks.\u00a0 So, here is the issue happen in Serebdupity 1.7.8 Update: SQL injection in Serendipity Before the 1.1 input is used in a SQL query, it is first passed [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"page-builder","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"default","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}}},"kbtopic":[43,117],"kbtag":[106],"mkb_version":[],"_links":{"self":[{"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/kb\/23177"}],"collection":[{"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/comments?post=23177"}],"version-history":[{"count":9,"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/kb\/23177\/revisions"}],"predecessor-version":[{"id":38214,"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/kb\/23177\/revisions\/38214"}],"wp:attachment":[{"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/media?parent=23177"}],"wp:term":[{"taxonomy":"kbtopic","embeddable":true,"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/kbtopic?post=23177"},{"taxonomy":"kbtag","embeddable":true,"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/kbtag?post=23177"},{"taxonomy":"mkb_version","embeddable":true,"href":"https:\/\/www.casbay.com\/guide\/wp-json\/wp\/v2\/mkb_version?post=23177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}