18 lines
No EOL
790 B
Text
18 lines
No EOL
790 B
Text
# Exploit Title: Wordpress plugin Buddypress <= 1.9.1 privilege escalation
|
|
# Date: 11/02/2014
|
|
# Exploit Author: Pietro Oliva
|
|
# Vendor Homepage: http://buddypress.org
|
|
# Software Link: http://downloads.wordpress.org/plugin/buddypress.1.9.1.zip
|
|
# Version: 1.9.1
|
|
# CVE : [CVE-2014-1889]
|
|
# Vulnerability patched in version 1.9.2
|
|
|
|
it is possible to perform a privilege escalation attack due to a lack of
|
|
permissions check in the group creation process. A malicious user could
|
|
exploit this vulnerability to take control of every group (change name,
|
|
description, avatar and settings).
|
|
To exploit this vulnerability you have to follow these steps:
|
|
|
|
1) Create a cookie named bp_new_group_id=<id_of_victim_group>
|
|
2) Visit the url http://example.com/groups/create/step/group-details/
|
|
3) Enjoy the power |