I had an interesting conversation with a pentester who told me he had found a buffer overflow in Wordpress. The person in question was really adamant that this was true. The client is a bit skeptical about the technical skills of the pentesting firm and asked my opinion.
So the question I have is this: has anyone ever heard that someone found a buffer overflow in WordPress by just making a GET request to some PHP?
My opinion: If this were true, he would have found a buffer overflow in the PHP interpreter, and that would be huge. So I do not think it is true.
EDIT: The BOF was in two places:
In a php function build by the client with the same payload as an XSS vulnerability (so something like 123">alert(0);
In the wp_session token with just a bunch of A's (~60)
It was all done externally with no access on the server in a routine quick pentest of around 10 different websites...
I'll update after doing an actual code review over the parts that should be vulnerable
EDIT: So I did the code review and it was indeed a BS story. Not only did the BOF's not exist at all, he actually said to have found a SQLi in a part of the code that did absolutely nothing with a database.
But at least the discussion in the comments was very insightfull about possibilities of BOF's these kind of standard platforms and CMS's so I learned a lot! Thanks!