CVE-2019-9978 PoC — WordPress social-warfare插件跨站脚本漏洞

Source

Associated Vulnerability

Readme

# CVE-2019-9978

### WordPress Plugin Social Warfare RCE Vulnerability < 3.5.3 🐞

#### Minimal simulated from vulnerable plugin and exploit it 🥰

## Installation Of Vulnerable Plugin

### Install dependencies:
```shell
docker-compose build
```
### Start vulnerable and attacker server containers
```shell
docker-compose up
```
or

```shell
docker-compose up -d
```

![docker-compose up -d](./images/1.png)

### Stop servers
```shell
docker-compose down
```

![docker-compose down](./images/2.png)

## Exploit

### Install exploit dependencies:
```shell
pip install -r requirements.txt
```

### Execute:
```shell
python3 exploit.py
```

![exploit](3.png)

### Enjoy 💀

File Snapshot

 [4.0K]  /data/pocs/ea7214dd0f18bc849723078e37a0571cf25f7805
├── [4.0K]  attacker-server
│   └── [  71]  evil.php
├── [ 661]  docker-compose.yaml
├── [1.0K]  exploit.py
├── [4.0K]  images
│   ├── [ 25K]  1.png
│   ├── [ 21K]  2.png
│   └── [ 82K]  3.png
├── [ 676]  README.md
├── [  46]  requirements.txt
└── [4.0K]  victim-server
    └── [ 664]  index.php

3 directories, 9 files

Remarks