Gli analisti di Patchstack hanno scoperto una vulnerabilità critica nel plugin TI WooCommerce Wishlist per WordPress. Il problema non è ancora stato risolto e può essere sfruttato dagli aggressori per scaricare file arbitrari.

TI WooCommerce Wishlist ha oltre 100.000 installazioni attive. Il plugin consente ai clienti del negozio online di salvare i loro prodotti preferiti per acquistarli in un secondo momento e di condividere tali elenchi con altri utenti sui social network. “Il plugin è vulnerabile al caricamento di file arbitrario, consentendo ad aggressori non autenticati di caricare file dannosi sul server”, avverte Patchstack.

Alla vulnerabilità è stato assegnato l’identificatore CVE-2025-47577 e ha ricevuto il punteggio massimo di 10 punti su 10 sulla scala CVSS. Il problema riguarda tutte le versioni del plugin elencate di seguito, inclusa la 2.9.2 del 29 novembre 2024.

Come hanno spiegato gli esperti, la radice del problema risiede nella funzione tinvwl_upload_file_wc_fields_factory, che a sua volta utilizza un’altra funzione integrata di WordPress, wp_handle_upload, per eseguire la convalida, ma imposta i parametri di override test_form e test_type su false.

Il parametro test_type viene utilizzato per verificare se il tipo di file MIME (Multipurpose Internet Mail Extension) corrisponde al tipo previsto, mentre test_form viene utilizzato per verificare se il parametro $_POST[‘action’] corrisponde al tipo previsto.

Di conseguenza, impostando test_type su false è possibile ignorare il controllo del tipo di file, consentendo quindi di caricare file di qualsiasi tipo.

Si noti che la funzione vulnerabile è accessibile tramite tinvwl_meta_wc_fields_factory e tinvwl_cart_meta_wc_fields_factory solo quando il plugin WC Fields Factory è attivo sul sito. Ciò significa che lo sfruttamento riuscito del bug è possibile solo se il plugin WC Fields Factory è attivo su un sito basato su WordPress e se l’integrazione è abilitata nel plugin TI WooCommerce Wishlist.

In caso di attacco, un aggressore ha la possibilità di caricare un file PHP dannoso ed eseguire codice in remoto accedendo direttamente al file caricato. Poiché non è ancora disponibile alcuna patch, si consiglia vivamente agli utenti del plugin di disattivarlo o rimuoverlo dai propri siti.

L'articolo Un bug di sicurezza con score 10 affligge un plugin WordPress con 100.000 installazioni proviene da il blog della sicurezza informatica.

Portal 2 is mostly known as the successful sequel to Valve’s weird physics platformer, Portal. It’s not really known for being a webserver. That might change, though, given the hard work of [PortalRunner].

Quite literally, [PortalRunner] hacked the Source engine and Portal 2 to actually run a working HTTP web server. That required setting up the code to implement a TCP network socket that was suitable for web traffic, since the engine primarily functions with UDP sockets for multiplayer use. This was achieved with a feature initially put in the Source engine for server management in the Left 4 Dead games. From there, the game engine just had to be set up to reply to HTTP requests on that socket with the proper responses a visiting browser expects. If the game engine responds to a browser’s connection request with a bunch of HTML, that’s what the browser will display. Bam! You’ve got a web server running in Portal 2.

From there, [PortalRunner] went further, setting things up so that the status of in-game objects effects the HTML served up to visiting web browsers. Move objects in the game, and the served web page changes. It’s pretty fun, and the complexity and features [PortalRunner] implements only get more advanced from there. When he gets into stacking companion cubes to write HTML in visual form, you’ll want to applaud the Minecraftian glory of it all.

The devil is really in the details on this one, and it’s a great watch. In reality, making Portal 2 into a simple web server is far easier than you might have thought possible. Valve’s physics masterpiece really is popular with hackers; we see it popping up around here all the time. Video after the break.

youtube.com/embed/-v5vCLLsqbA?…

hackaday.com/2025/06/01/portal…

Since the tail end of World War II, humanity has struggled to deal with its newfound ability to harness the tremendous energy in the nucleus of the atom. Of course there have been some positive developments like nuclear power which can produce tremendous amounts of electricity without the greenhouse gas emissions of fossil fuels. But largely humanity decided to build a tremendous nuclear weapons arsenal instead, which has not only cause general consternation worldwide but caused specific problems for one scientist in particular.

[Steve Weintz] takes us through the tale of [Dr. John C. Clark] who was working with the Atomic Energy Commission in the United States and found himself first at a misfire of a nuclear weapons test in the early 1950s. As the person in charge of the explosive device, it was his responsibility to safely disarm the weapon after it failed to detonate. He would find himself again in this position a year later when a second nuclear device sat on the test pad after the command to detonate it was given. Armed with only a hacksaw and some test equipment he was eventually able to disarm both devices safely.

One note for how treacherous this work actually was, outside of the obvious: although there were safety devices on the bombs to ensure the nuclear explosion would only occur under specific situations, there were also high explosives on the bomb that might have exploded even without triggering the nuclear explosion following it. Nuclear bombs and nuclear power plants aren’t the only things that the atomic age ushered in, though. There have been some other unique developments as well, like the nuclear gardens of the mid 1900s.

hackaday.com/2025/05/31/disarm…

Today we heard from [Richard James Howe] about his new CPU. This new 16-bit CPU is implemented in VHDL for an FPGA.

The really cool thing about this CPU is that it eschews the typical program counter (PC) and replaces it with a linear-feedback shift register (LFSR). Apparently an LFSR can be implemented in hardware with fewer transistors than are required by an adder.

Usually the program counter in your CPU increments by one, each time indicating the location of the next instruction to fetch and execute. When you replace your program counter with an LFSR it still does the same thing, indicating the next instruction to fetch and execute, but now those instructions are scattered pseudo-randomly throughout your address space!

When the instructions for your program are distributed pseudo-randomly throughout your address space you find yourself in need of a special compiler which can arrange for this to work, and that’s what this is for. Of course all of this is shenanigans and is just for fun. This isn’t the first time we’ve heard from [Richard], we have seen his Bit-Serial CPU and Forth System-On-Chip in recent history. Glad to see he’s still at it!

Thanks to [Richard James Howe] for letting us know about this latest development.

hackaday.com/2025/05/31/can-we…

Motorized faders are very cool, and you can find them in everything from expensive mixing desks to high-end video editing decks. If you want to build your own wireless motorized fader controls for your own projects, you might like this project from [Ian Peterson].

Faders are useful controls, but they’re usually very one-way devices—you set them to what you want, and that’s it. However, motorized faders are a little fancier. You can move them yourself, or they can be moved under the command of other hardware or software—making a control change automatically that is still visible to the human in front of the control panel.

[Ian Peterson] built his OSCillator motorized fader for his work with lighting consoles in theater contexts. Its name references the Open Sound Control (OSC) platform which is commonly used across various lighting consoles. His build relies on an ESP32 to run the show, which communicates with other lighting hardware via WiFi. The microcontroller is responsible for reading the position of the fader and built-in button, and sending the relevant commands to other lighting devices on the network. At the same time, it must also listen to commands from lighting consoles on the network and update the motorized fader’s position in turn if the relevant control it’s mapped to has been changed elsewhere.

If you’re working in theater or film and you’re wanting to control lighting cues wirelessly, a tool like this can really come in handy. We don’t see a lot of motorized faders in DIY projects, but they pop up now and then.

youtube.com/embed/HpvctEU85Tk?…

hackaday.com/2025/05/31/buildi…

Il 9 febbraio avevo cancellato l'account Facebook, il sistema mi aveva detto che per 30 giorni sarebbe stato solo disattivato e che l'eliminazione vera e propria sarebbe avvenuta solo 30 giorni dopo.

Siamo al 30 maggio e il mio account è ancora lì.

Stasera sono nuovamente entrato e ho rifatto la procedura, al termine della quale il sistema mi ha ancora una volta confermato che la mia richiesta di cancellazione era stata ricevuta, che l'account era stato programmato per l'eliminazione ma che per 30 giorni sarebbe stato solo disattivato, casomai avessi cambiato idea.

Qualcuno di voi è riuscito a cancellarsi per davvero?

Nel frattempo ho scritto al Garante per la Privacy segnalando il problema e chiedendo come fare per poter vedere rispettato il mio diritto ad essere rimosso da quel social network.

Ho visto il primo episodio di Adolescence.

Non avrei mai dovuto farlo.