CVE-2018-6389 PoC — WordPress 安全漏洞

Description

load-scripts.php file, which purpose is to retrieve several JavaScript packages through one single request.

介绍

# Wordpress-DOS-Attack-CVE-2018-6389

[![Build Status](https://travis-ci.org/joemccann/dillinger.svg?branch=master)](https://www.cvedetails.com/cve/CVE-2018-6389)

Load-scripts.php file, which purpose is to retrieve several JavaScript packages through one single request.
```sh
$ chmod +x Execute.sh
$ ./Execute.sh
```

# How it Works!
- The problem lies upon the load-scripts.php file, which purpose is to retrieve several Javascript packages through one single request, such as bootstrap, jquery, and jqueryUI, among others.

- It is possible to create a special request to retrieve a huge quantity of different Javascripts, resulting in a high CPU resource and high bandwidth usage.

- Using a simple tool, it is possible to send hundreds of requests per second, which can easily increase RAM and CPU usage to the limit, resulting in a web server failure that would prevent users from accessing the attacked website or any other websites hosted on the same server.

<p align="center">
  <img src="IMG.png" width="350" alt="accessibility text">
</p>


-------------------------------------------------------------------------------------------------------------------------------------------

文件快照

备注