# N/A
## 漏洞概述
在 WordPress 的 Social Warfare 插件版本 3.5.3 之前的版本中，存在存储型 XSS 漏洞。攻击者可以通过 `wp-admin/admin-post.php?swp_debug=load_options` 中的 `swp_url` 参数触发该漏洞。此漏洞在 2019 年 3 月被利用。
## 影响版本
- Social Warfare < 3.5.3
- Social Warfare Pro < 3.5.3
## 漏洞细节
攻击者可以通过 `wp-admin/admin-post.php?swp_debug=load_options` URL 中的 `swp_url` 参数注入恶意脚本，进而导致存储型 XSS 漏洞。
## 影响
该漏洞允许攻击者通过注入恶意脚本，在受影响的 WordPress 网站上执行跨站脚本攻击，可能导致用户的会话信息被盗取或其他安全问题。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2019-9978 - RCE on a Wordpress plugin: Social Warfare < 3.5.3 | https://github.com/mpgn/CVE-2019-9978 | POC详情 |
| 2 | CVE-2019-9978 - (PoC) RCE in Social WarFare Plugin (<=3.5.2) | https://github.com/hash3liZer/CVE-2019-9978 | POC详情 |
| 3 | Wordpress Social Warfare Remote Code Execution (AUTO UPLOAD SHELL) | https://github.com/KTN1990/CVE-2019-9978 | POC详情 |
| 4 | cve-2019-9978 | https://github.com/cved-sources/cve-2019-9978 | POC详情 |
| 5 | Social WarFare Plugin (<=3.5.2) Remote Code Execution | https://github.com/d3fudd/CVE-2019-9978_Exploit | POC详情 |
| 6 | Remote Code Execution in Social Warfare Plugin before 3.5.3 for Wordpress. | https://github.com/grimlockx/CVE-2019-9978 | POC详情 |
| 7 | python3 version of the CVE-2019-9978 exploit | https://github.com/h8handles/CVE-2019-9978-Python3 | POC详情 |
| 8 | None | https://github.com/20dani09/CVE-2019-9978 | POC详情 |
| 9 | cve-2019-9978 PoC | https://github.com/0xMoonrise/cve-2019-9978 | POC详情 |
| 10 | None | https://github.com/MAHajian/CVE-2019-9978 | POC详情 |
| 11 | A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting versions below 3.5.3. | https://github.com/echoosso/CVE-2019-9978 | POC详情 |
| 12 | WordPress Social Warfare plugin before 3.5.3 contains a cross-site scripting vulnerability via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, affecting Social Warfare and Social Warfare Pro. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9978.yaml | POC详情 |
| 13 | The `swp_debug` parameter in `admin-post.php` allows remote attackers to include external files containing malicious PHP code, which are evaluated on the server. By supplying a crafted URL that hosts a reverse shell payload, an attacker can gain command execution. | https://github.com/Housma/CVE-2019-9978-Social-Warfare-WordPress-Plugin-RCE | POC详情 |
| 14 | payload txt | https://github.com/xxoprt/payloadCVE-2019-9978 | POC详情 |
| 15 | A custom Python proof-of-concept showcasing root-cause analysis and exploitation of CVE 2019-9978 (Social Warfare plugin),focusing on practical RFI to RCE attack flow. | https://github.com/Vaidehim55/CVE-2019-9978-RCE-PoC | POC详情 |
Venture into the epic sandbox of EVE Online. Shape your destiny today. Conquer alongside millions of pilots worldwide. <a href=https://www.eveonline.com/signup?invc=46758c20-63e3-4816-aa0e-f91cff26ade4>Download free</a>
Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.