RIPS Tech Blog
blog.ripstech.com · Company blog · on HN since 2016
RIPS Tech Blog, from a code analysis security company, publishes vulnerability research on WordPress, Joomla, and Moodle.
What HN saysHN links it for WordPress and CMS exploits. One commenter notes a file-delete-to-code-execution bug it disclosed took over seven months to fix and was still unpatched when published.
16HN people shared it
1linked it in comments
20stories submitted
160story points
7 years agolast shared
2016people per year2026
Most-shared posts
- 1Joomla – Takeover in 20 Seconds with LDAP Injection3 people · 11 points · first shared 2017 · discussion on HN
- 2Unpatched WordPress vulnerability allows code execution for authors2 people · 29 points · first shared 2018 · 22 comments on HN
- 3WordPress 5.0.0 Remote Code Execution2 people · 8 points · first shared 2019 · discussion on HN
- 4WordPress Design Flaw Leads to WooCommerce RCE2 people · 6 points · first shared 2018 · discussion on HN
- 5WordPress 5.1 CSRF to Remote Code Execution2 people · 6 points · first shared 2019 · discussion on HN
- 6Evil Teacher: Code Injection in Moodle1 people · 77 points · first shared 2018 · 26 comments on HN
- 7Joomla Privilege Escalation via SQL Injection1 people · 6 points · first shared 2018 · discussion on HN
- 8The State of Wordpress Security1 people · 6 points · first shared 2016 · 1 comments on HN
- 9WordPress Privilege Escalation Through Post Types1 people · 2 points · first shared 2018 · discussion on HN
- 10How to securely extract archives in java1 people · 2 points · first shared 2019 · discussion on HN
- 11Roundcube Command Execution via Email1 people · 2 points · first shared 2016 · discussion on HN
- 12Bitbucket 6.1.1 Path Traversal to RCE1 people · 2 points · first shared 2019 · discussion on HN
- 13A technical analysis of automatically detected vulnerabilities in SugarCRM1 people · 1 points · first shared 2017 · discussion on HN
- 14PHP Security Advent Calendar 2018 Announcement1 people · 1 points · first shared 2018 · discussion on HN
- 15Privilege Escalation in 2.3M WooCommerce Shops1 people · 1 points · first shared 2018 · discussion on HN
What HN people wrote when they linked it
SahAssar · 2018-07-06
It took more than 7 months to fix https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution… and at the time rips went public with it (after waiting for 7 months) it still was not fixed.
That a POST param even was used to as the path to a file to delete without sanitizing it is not usually indicative of "secure coding practices".