CVE-2019-9787 PoC — WordPress 跨站请求伪造漏洞

Source

https://github.com/dexXxed/CVE-2019-9787

Associated Vulnerability

Title:WordPress 跨站请求伪造漏洞 (CVE-2019-9787)
Description:WordPress是WordPress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 5.1.1之前版本中存在安全漏洞，该漏洞源于程序没有正确地过滤评论内容。远程攻击者可利用该漏洞执行代码并控制WordPress网站。

Description

Overview PoC of CSRF CVE-2019-9787 WordPress Version 5.1.1

Readme

# CVE-2019-9787 CSRF PoC

## Overview
PoC of CSRF CVE-2019-9787
WordPress Version 5.1.1
[CVE-2019-9787](https://blog.ripstech.com/2019/wordpress-csrf-to-rce/)

Do not use this, EXCEPT for TEST purpose.

## Installation

```
docker-compose up -d
```

## Attack

1. Access http://localhost:8080/wp-admin/install.php and install WordPress. you only have to create WP admin account.

<p align="center">
  <img width="547" height="637" src="./screenshots/1.JPG">
</p>

2. Access http://localhost:8080/?p=1#comments as a visitor, and post comment like "Hacker Attack http://localhost/".

<p align="center">
  <img width="796" height="460" src="./screenshots/2.JPG">
</p>

<p align="center">
  <img width="711" height="642" src="./screenshots/3.JPG">
</p>

<p align="center">
  <img width="674" height="240" src="./screenshots/4.JPG">
</p>

3. Click the link posted at 2.

<p align="center">
  <img width="1206" height="131" src="./screenshots/5.JPG">
</p>

<p align="center">
  <img width="539" height="128" src="./screenshots/6.JPG">
</p>


4. You will see the comment "CSRF Attack made Successfully!" is posted by user you currently logged in.

<p align="center">
  <img width="1178" height="122" src="./screenshots/7.JPG">
</p>

<p align="center">
  <img width="665" height="459" src="./screenshots/8.JPG">
</p>

File Snapshot


 [4.0K]  /data/pocs/e75aecdc4508167a7836143dcdd6af99d3a44e72
├── [ 690]  docker-compose.yml
├── [4.0K]  nginx
│   ├── [ 282]  iframe-post.html
│   └── [ 153]  index.html
├── [1.3K]  README.md
└── [4.0K]  screenshots
    ├── [ 32K]  1.JPG
    ├── [ 33K]  2.JPG
    ├── [ 40K]  3.JPG
    ├── [ 19K]  4.JPG
    ├── [ 22K]  5.JPG
    ├── [ 17K]  6.JPG
    ├── [ 21K]  7.JPG
    └── [ 40K]  8.JPG

2 directories, 12 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!