PHP Vulnerabilities

Website
1

You might have seen in the news there are some critical vulnerabilities relating to PHP which is the language the main WOTA website uses (the discourse server is unaffected).

The main site uses something called a CMS which is a framework on which the site has been constructed. It has not really been updated since the site was first created, so the CMS software is very out of date as is the version of PHP that is used.

As a result there is very little that can be done if a vulnerability was announced that affects the site to mitigate risks. As it happens in this case it is upload functionality that is exploited, and we don’t do that with the main site. What settings I can change have been changed, but again they are mostly irrelevant due to the very old version of PHP in use.

Please let me know if you experience any oddities using the main site moving forward.

Regards, Mark.

2

Thanks for all your background work on this stuff, mark, keeping the WOTA ship afloat. 73, Phil

3

Hi Mark,

Interestingly at work the WOTA site comes up with error 403 in any normal browser. However i am using the TOR browser and it loads fine. WOTA works fine at home and on my phone so it is something to do with our internet at work. It sounds like it is the old version of PHP that the WOTA site runs. At least that is my theory!

73’s Geoff GM4WHA

4

there’s probably something missing in the headers, or bad. I’ll take a look as it should work everywhere I think I’ve seen this before.