CVE-2018-6389 PoC — WordPress 安全漏洞

Source

https://github.com/JavierOlmedo/wordpress-cve-2018-6389

Associated Vulnerability

Title: WordPress 安全漏洞 (CVE-2018-6389)
Description:In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

Description

CVE-2018-6389 WordPress Core - 'load-scripts.php' Denial of Service <= 4.9.4

Readme

# WordPress-CVE-2018-6389

## WordPress Core - 'load-scripts.php' Denial of Service <= 4.9.4

**Date:** 05/02/2018

**Software Link:** [WordPress](https://wordpress.org/)

**Version:** <= 4.9.4

**Tested on:** KaLi Linux 2018.1

**CVE:** [CVE-2018-6389](https://www.certsi.es/en/early-warning/vulnerabilities/cve-2018-6389)

**Discovered by:** [Barak Tawily](https://github.com/Quitten)

**Exploit by:** [Javier Olmedo](https://twitter.com/jjavierolmedo)
## HOW TO USE?
Clone this repository
```
git clone https://github.com/JJavierOlmedo/wordpress-cve-2018-6389.git
```
Go to local repository
```
cd wordpress-cve-2018-6389
```
Change the access permissions
```
sudo chmod +x wordpress-cve-2018-6389.py
```
Launch attack!!
```
python3 wordpress-cve-2018-6389.py -u <TARGET> -t <THREADS>
```
## PoC
![cve-2018-6389](https://hackpuntes.com/wp-content/uploads/2018/03/cve-2018-6389.gif)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →