CVE-2022-3590 PoC — WordPress 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3590.yaml

Associated Vulnerability

Title:WordPress 代码问题漏洞 (CVE-2022-3590)
Description:WordPress是WordPress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress存在代码问题漏洞，该漏洞源于pingback功能中未经验证的服务器端请求伪造。

Description

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

File Snapshot


 id: CVE-2022-3590

info:
  name: WordPress <= 6.2 - Server Side Request Forgery
  author: riteshs4hu

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!