LUG STIKOM

http://www.example.com/wp-login.php?action=rp&key=o7naCKN3OoeU2KJMMsag

http://www.example.com/wp-login.php?action=rp&key[]=

wp-login.php:
...[snip]....
line +/- 186:
function reset_password($key) {
    global $wpdb;
 
    $key = preg_replace('/[^a-z0-9]/i', '', $key);
 
    if ( empty( $key ) )
        return new WP_Error('invalid_key', __('Invalid key'));
 
    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key));
    if ( empty( $user ) )
        return new WP_Error('invalid_key', __('Invalid key'));
...[snip]....
line +/- 276:
$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';
$errors = new WP_Error();
 
if ( isset($_GET['key']) )
    $action = 'resetpass';
 
// validate action so as to default to the login screen
if ( !in_array($action, array('logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login')) && false === has_filter('login_form_' . $action) )
    $action = 'login';
...[snip]....
 
line +/- 370:
 
break;
 
case 'resetpass' :
case 'rp' :
    $errors = reset_password($_GET['key']);
 
    if ( ! is_wp_error($errors) ) {
        wp_redirect('wp-login.php?checkemail=newpass');
        exit();
    }
 
    wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
    exit();
 
break;
...[snip ]...

case 'resetpass' :
case 'rp' :
	$errors = reset_password($_GET['key']);
 
	if ( ! is_wp_error($errors) ) {
		wp_redirect('wp-login.php?checkemail=newpass');
		exit();
	}
 
	wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
	exit();
 
break;

case 'resetpass' :
case 'rp' :
	if (is_array($_GET['key'])) {
		die("<strong>Hacking detected.</strong>");
		exit();
	}
	$errors = reset_password($_GET['key']);
 
	if ( ! is_wp_error($errors) ) {
		wp_redirect('wp-login.php?checkemail=newpass');
		exit();
	}
 
	wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
	exit();
 
break;

$ patch wp-login.php -i wp-login.php.patch