search

wpscanteam / wpscan

WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com
https://wpscan.com/wordpress-cli-scanner
Other
8.59k stars 1.26k forks source link

wpscan finds wrong version of plugins #857

Closed JayKey closed 9 years ago

JayKey commented 9 years ago

tl;dr: Wpscan finds YARPP in version 4.2.4 while I have latest one (4.2.5) installed.

While scanning Wpscan finds YARPP in version 4.2.4. First time around that was correct. After the scan I updated each plugin and base Wordpress. I run another scan, and Wpscan still shows YARPP to be in version 4.2.4 when it's in 4.2.5 version according to Wordpress backend. Is there some issue with finding YARPP version in Wpscan or something is wrong on Wordpress end?

I have the same issue with WP Socializer, Wpscan shows 2.4.2, Wordpress - 2.4.9.8.

erwanlr commented 9 years ago

Unable to reproduce. I installed YARPP 4.2.4 & wp-socializer 2.4.4, ran a scan then updated them re-ran a scan, versions are correctly detected.

Note: The plugin version is displayed along with the plugin name, and not in the vulnerability title

[+] Name: wp-socializer - v2.4.9.8
 |  Location: http://wp.lab/wordpress-4.2/wp-content/plugins/wp-socializer/
 |  Readme: http://wp.lab/wordpress-4.2/wp-content/plugins/wp-socializer/readme.txt
[!] Directory listing is enabled: http://wp.lab/wordpress-4.2/wp-content/plugins/wp-socializer/

[!] Title: WP Socializer 2.4.2 - admin/wpsr-services-selector.php val Parameter XSS
    Reference: https://wpvulndb.com/vulnerabilities/7053
    Reference: https://secunia.com/advisories/49824/
    Reference: http://osvdb.org/show/osvdb/83645

The vulnerability affecting the 2.4.2 is displayed there as we were not aware of a fix, I have checked and this issue has been resolved in the 2.4.3. I have update the DB to reflect that, hence the issue will not be displayed if the detected version is >= 2.4.3 (will require an ./wpscan.rb --update)

Back to your issue, can you post the output of the identified plugins ?

erwanlr commented 9 years ago

Any news ?

JayKey commented 9 years ago

everything is working now, it was a problem on my end

2015-09-17 17:28 GMT+02:00 erwanlr notifications@github.com:

Any news ?

— Reply to this email directly or view it on GitHub https://github.com/wpscanteam/wpscan/issues/857#issuecomment-141122277.

erwanlr commented 9 years ago

Ok, closing then :)