CVE-2018-6389 PoC — WordPress 安全漏洞

Source

https://github.com/JavierOlmedo/wordpress-cve-2018-6389

Associated Vulnerability

Title:WordPress 安全漏洞 (CVE-2018-6389)
Description:WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 4.9.2及之前版本中存在安全漏洞。攻击者可通过使用较大的registered .js文件列表，创建请求来多次加载文件利用该漏洞造成拒绝服务（资源消耗）。

Description

CVE-2018-6389 WordPress Core - 'load-scripts.php' Denial of Service <= 4.9.4

Readme

# WordPress-CVE-2018-6389

## WordPress Core - 'load-scripts.php' Denial of Service <= 4.9.4

**Date:** 05/02/2018

**Software Link:** [WordPress](https://wordpress.org/)

**Version:** <= 4.9.4

**Tested on:** KaLi Linux 2018.1

**CVE:** [CVE-2018-6389](https://www.certsi.es/en/early-warning/vulnerabilities/cve-2018-6389)

**Discovered by:** [Barak Tawily](https://github.com/Quitten)

**Exploit by:** [Javier Olmedo](https://twitter.com/jjavierolmedo)
## HOW TO USE?
Clone this repository
```
git clone https://github.com/JJavierOlmedo/wordpress-cve-2018-6389.git
```
Go to local repository
```
cd wordpress-cve-2018-6389
```
Change the access permissions
```
sudo chmod +x wordpress-cve-2018-6389.py
```
Launch attack!!
```
python3 wordpress-cve-2018-6389.py -u <TARGET> -t <THREADS>
```
## PoC
![cve-2018-6389](https://hackpuntes.com/wp-content/uploads/2018/03/cve-2018-6389.gif)

File Snapshot


 [4.0K]  /data/pocs/1d61f0940c795985468129e3e9e7357fa93569de
├── [1.1K]  LICENSE.md
├── [ 885]  README.md
└── [7.9K]  wordpress-cve-2018-6389.py

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!