{"id":2626,"date":"2015-03-12T11:26:34","date_gmt":"2015-03-12T09:26:34","guid":{"rendered":"https:\/\/www.stradiji.com\/?p=2626"},"modified":"2022-04-26T10:11:35","modified_gmt":"2022-04-26T07:11:35","slug":"wordpress-seo-by-yoast-eklentisinde-guvenlik-acigi","status":"publish","type":"post","link":"https:\/\/www.stradiji.com\/tr\/wordpress-seo-by-yoast-eklentisinde-guvenlik-acigi\/","title":{"rendered":"WordPress SEO By Yoast Eklentisinde G\u00fcvenlik A\u00e7\u0131\u011f\u0131"},"content":{"rendered":"

\"wordpress<\/a><\/p>\n

The Hacker News<\/a> taraf\u0131ndan yap\u0131lan a\u00e7\u0131klamaya g\u00f6re, pop\u00fcler WordPress eklentisi \u201cYoast\u201d, g\u00fcvenlik a\u00e7\u0131\u011f\u0131 nedeniyle milyonlarca WordPress kullan\u0131c\u0131s\u0131n\u0131 etkiledi.<\/p>\n

A\u00e7\u0131klamaya g\u00f6re Yoast SEO eklentisinin 1.7.3.3 s\u00fcr\u00fcm\u00fc, \u201cBlind SQL Injection\u201d diye adland\u0131r\u0131lan t\u00fcrden bir g\u00fcvenlik a\u00e7\u0131\u011fa sahip. Bu a\u00e7\u0131k vas\u0131tas\u0131yla, eklentiyi kullanan bir WordPress sitesinin sald\u0131r\u0131lara kar\u015f\u0131 g\u00fcvensiz olmas\u0131 s\u00f6z konusu olabilir. The\u00a0Hacker News\u2019ten Mohit Kumar\u2019\u0131n a\u00e7\u0131klamas\u0131 aynen \u015fu \u015fekilde:<\/p>\n

Temel olarak SQL injection sald\u0131r\u0131s\u0131nda sald\u0131rgan, kullan\u0131c\u0131 taraf\u0131ndaki sorgulara hatal\u0131 bi\u00e7imlendirilmi\u015f SQL sorgusu ekleyerek istemciyi etkileyebilir.\u00a0Sald\u0131rgan, eklentinin yaratt\u0131\u011f\u0131 a\u00e7\u0131\u011fa do\u011frudan eri\u015femez, hata, bu kod sat\u0131r\u0131nda yer almaktad\u0131r: \u201cadmin\/class-bulk-editor-list-table.php\u201d .<\/p>\n

Bu kod sat\u0131r\u0131na eri\u015fim, Admin, Edit\u00f6r veya Yazar yetkisi verilmi\u015f ki\u015filere a\u00e7\u0131kt\u0131r.\u00a0Bu nedenle, sald\u0131rgan\u0131n bu a\u00e7\u0131ktan yararlanabilmesi i\u00e7in, yetkili kullan\u0131c\u0131lar\u0131 kand\u0131rmas\u0131 yeterlidir. Yetkili kullan\u0131c\u0131lar\u0131, sald\u0131rgan\u0131n ihtiyac\u0131 olan bilgileri elde etmesi i\u00e7in t\u0131klamalar\u0131 gereken sahte bir URL ile kand\u0131rmas\u0131 m\u00fcmk\u00fcn olabilir.<\/p><\/blockquote>\n

Yani, Admin’i oldu\u011funuz bir sayfan\u0131n ele ge\u00e7irilmesi i\u00e7in, sahte bir linke t\u0131klaman\u0131z yeterli. Linke t\u0131klad\u0131\u011f\u0131n\u0131zda, SQL injection sald\u0131r\u0131s\u0131 meydana geliyor. Atak bir defa ger\u00e7ekle\u015fti\u011finde, sald\u0131rgan kendisine Admin yetkisi verebilecek duruma geliyor ve i\u00e7erik y\u00f6netim sistemini ele ge\u00e7irerek istedi\u011fini yapabiliyor.<\/p>\n

Ancak bu problem, eklentinin 1.7.4 s\u00fcr\u00fcm\u00fcne y\u00fckseltilmesiyle \u00e7\u00f6z\u00fclebilmekte. Yani, e\u011fer Yoast SEO eklentisini kullan\u0131yorsan\u0131z, vakit kaybetmeden eklentinizi g\u00fcncelleyin. Ayn\u0131 g\u00fcncelleme, eklentinin premium versiyonu i\u00e7in de geldi.<\/p>\n

Bu a\u00e7\u0131dan, WordPress ve Eklenti g\u00fcncellemelerini s\u0131k s\u0131k kontrol etmenizi, yeni g\u00fcncellemeleri ka\u00e7\u0131rmaman\u0131z\u0131 tavsiye ederiz. Ya\u015fanan g\u00fcvenlik problemi sadece Yoast SEO eklentisi i\u00e7in ge\u00e7erli olmayabilir, di\u011fer eklentilerde de benzer problemlerle kar\u015f\u0131la\u015fmam\u0131z s\u00f6z konusu olabilir.<\/p>\n

E\u011fer Yoast SEO\u2019ya g\u00fcvenmiyorsan\u0131z, All in One SEO eklentisini deneyebilirsiniz, All in One, Yoast SEO kadar yetenekli olmasa da, her haliyle SEO i\u00e7in optimize olan WordPress i\u00e7in bir eklentiye bu kadar y\u00fck bindirmek mant\u0131kl\u0131 g\u00f6r\u00fcnm\u00fcyor. Ayr\u0131ca, herkesin Yoast SEO eklentisini kurarak\u00a0SEO’yu domine etmesi gibi bir durum s\u00f6z konusu olmad\u0131\u011f\u0131ndan, \u00e7e\u015fitlili\u011fin ve farkl\u0131 se\u00e7eneklerin olmas\u0131 \u00e7ok daha sa\u011fl\u0131kl\u0131 diye d\u00fc\u015f\u00fcn\u00fcyoruz.<\/p>\n","protected":false},"excerpt":{"rendered":"

WordPress, kullan\u0131c\u0131lar\u0131na hemen her amaca hizmet eden eklentiler sunmas\u0131yla nam salm\u0131\u015f bir i\u00e7erik y\u00f6netim sistemi. Ancak kimi zaman bu eklentiler ciddi \u015fekilde g\u00fcvenlik a\u00e7\u0131klar\u0131na da yol a\u00e7abiliyorlar.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[127,128,129,130,36,37,131,132],"class_list":["post-2626","post","type-post","status-publish","format-standard","hentry","category-arama-motoru-optimizasyonu","tag-all-in-one-seo","tag-eklenti","tag-guvenlik","tag-plugin","tag-seo","tag-wordpress","tag-yoast","tag-yoast-seo"],"_links":{"self":[{"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/posts\/2626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/comments?post=2626"}],"version-history":[{"count":0,"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/posts\/2626\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/media?parent=2626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/categories?post=2626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stradiji.com\/tr\/wp-json\/wp\/v2\/tags?post=2626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}