[GET] CodeCanyon - WP Feedback, Survey and Quiz Manager - Pro v 2.5.1

[NotSo Invisible]

For clarification, the mention of "Codecanyon recently released a notice regarding the fact that many of their plugins contain harmful code that can be used maliciously" is referring exactly to a practice which has gone on for years where developers weren't properly escaping when using:

Code:

"add_query_arg() and remove_query_arg() functions".

WordPress had not fully explained the use of those functions in the Codex. Simply making a statement that WordPress plugins on Codecanyon are using "harmful code" is not exactly a correct statement.

The statement made by Envato is "This is a general community announcement to bring your attention to an XSS vulnerability affecting multiple WordPress plugins and themes." And they give links to sites explaining what that vulnerability is about.

There has been a major coordinated update which has been going on for about three days. Thousands of plugins have updated during that time in the WordPress Repository and Envato has been successfully getting plugin and theme developers to do updates as well.

Again, this is a vulnerability which has been present for years. But now it is in the process of being fixed globally.

The implication made that the plugin offered here might be one of those plugins and that "bimple" fixed it is false. The changed "code" in the alternate download on this thread has nothing to do with those vulnerabilities.

Code:

I will say that the add_query_arg() function is called 24 times in this plugin and none of them are correctly escaped either in the OP download or the alternate "corrected" files.

So, I will have to say that this plugin version is most likely still containing the XSS Vulnerability contrary to the claim by "bimple" of fixing and re-uploading it.

The claim by "bimple" of "I cleaned them and re-upped them.", no that didn't happen. The vulnerability is still there.

[bimple]

read my post again - I never claimed to clean it of the envato mentioned code - I used that code as an exampole of malicious code that has escaped virustotal. I stated that I ran it in WP Security Hero, and ran the malicious code scanner, and it cleaned those files so I rezipped them and uploaded them as a courtesy to the forum, but as I stated - don't worry, it will never ever happen again.

(04-25-2015 03:28 PM)NotSo Invisible Wrote:  The claim by "bimple" of "I cleaned them and re-upped them.", no that didn't happen. The vulnerability is still there.

---

(04-25-2015 02:15 PM)NotSo Invisible Wrote:  In your vast experience where have you managed to come up with those tags being "malware or malicious"?

I would suggest there be further enlightening on your part because you are attempting to damage someone's reputation here on BBHF and some of us who pay attention will call you out for it. If you believe those tags are malicious, then maybe you should be more a browser than a participant.

And your claim that "I am aware that many of these files contain exploits, so I cleaned them and re-upped them." is absolutely false. The files are exactly the same throughout the entire plugin except for the file you named above. And the only difference between your file and the OP file is what I pointed out.

I am not attempting to ruin anyone's reputation here - that is ridiculous - I was simply trying to re-share files that had been cleaned by WP Security Hero, which does a good job of finding MALICIOUS CODE (their term, not mine - I simply cut and paste what the plugin spit out). As stated earlier, don't worry, I won't fix and reupload the plugins for anyone elses benefit.

---

(04-25-2015 03:02 PM)qsuccess Wrote:  @lostinheaven Thxs! +5Reps It's free to use WP Security Hero: http://bestblackhatforum.com/showthread....pid1213235 ;-)

I don't give a crap about any rep, so do whatever you want however
he wasn't the one suggesting using WP Security Hero - I was. he was stating it did a crappy job and removed nothing malicious.