CVE-2021-25075 PoC — WordPress plugin Duplicate Page or Post 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25075.yaml

Associated Vulnerability

Title:WordPress plugin Duplicate Page or Post 安全漏洞 (CVE-2021-25075)
Description:WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是WordPress开源的一个应用插件。 WordPress plugin Duplicate Page or Post 插件 1.5.1之前版本存在安全漏洞，该漏洞源于插件没有CSRF检查，攻击者可利用该漏洞执行跨站点脚本攻击。

Description

WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing unauthenticated users to call it and change the plugin's settings, or perform such attack via cross-site request forgery.

File Snapshot


 id: CVE-2021-25075

info:
  name: WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting
  a

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!