WordPress 4.7 / 4.7.1 REST API Content Injection Exploit

Usage Info msf use auxiliary/scanner/http/wordpresscontentinjection msf auxiliarywordpresscontentinjection show actions ...actions... msf auxiliarywordpresscontentinjection set ACTION msf auxiliarywordpresscontentinjection show options ...show and set options... msf...

Information Disclosure

spark-core is vulnerable to information disclosure. The vulnerability is possible due to a flaw in the security filter not performing authentication at the application level but instead at the roof of the UI. Therefore, the data and application in the SHS can be accessed through the REST API by a...

WordPress 4.7.x < 4.7.2 REST API 'id' Parameter Privilege Escalation

The WordPress application running on the remote web server is version 4.7.x prior to 4.7.2. It is, therefore, affected by a privilege escalation vulnerability in the REST API due to a failure to properly sanitize user-supplied input to the 'id' parameter when editing or deleting blog posts. An...

The new aeration WordPress REST API content injection vulnerability details-vulnerability warning-the black bar safety net

Recently, from the Sucuri researchers discovered WordPress there are significant vulnerabilities, vulnerabilities that WordpressREST API, the successful exploitation of the vulnerability could delete pages or modify the page content. The official quickly released an upgraded version of Wordpress,...

F5 Networks BIG-IP : BIG-IP REST vulnerability (K12685114)

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files. CVE-2016-6249 Impact An...

WordPress 4.7.0 / 4.7.1 Plugin Insert PHP - PHP Code Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection Exploit Author: sucuri.net @sucurisecurity Date: 2017-02-09 Google Dork : inurl:/wp-content/plugins/insert-php/ Vendor Homepage:...

WordPress 4.7.0 / 4.7.1 Insert PHP Code Injection

Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection Exploit Author: sucuri.net @sucurisecurity Date: 2017-02-09 Google Dork : inurl:/wp-content/plugins/insert-php/ Vendor Homepage: https://fr.wordpress.org/plugins/insert-php/ Tested on: MSWin32 Version: 3.3.1 Explanation :...

1.5M Unpatched WordPress Sites Hacked Following Vulnerability Disclosure

Attackers have taken a liking to a content-injection vulnerability disclosed last week and patched in WordPress 4.7.2 that experts say has been exploited to deface 1.5M sites so far. The issue has evolved into “one of the worst WordPress related vulnerabilities to emerge in some time,” researcher...

Wordpress content injection vulnerability induced Super of 67,000 a site being black production use-vulnerability warning-the black bar safety net

! http://p7.qhimg.com/t0103be813526052f73.jpg From the latest WordPress vulnerability over 67,000 sites to be attacked If your website uses WordPress, and there is no timely update official last week released a patch, upgrade to v4. 7. 2 versions, then your site is likely to be this 4 a hacking...

WordPress < 4.7.2 Multiple Vulnerabilities

Binary data 9950.prm...

WordPress Plugin Insert PHP 3.3.1 - PHP Code Injection

WordPress Plugin Insert PHP 3.3.1 - PHP Code Injection Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection Exploit Author: sucuri.net @sucurisecurity Date: 2017-02-09 Google Dork : inurl:/wp-content/plugins/insert-php/ Vendor Homepage:...

WordPress Plugin Insert PHP 3.3.1 - PHP Code Injection

Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection Exploit Author: sucuri.net @sucurisecurity Date: 2017-02-09 Google Dork : inurl:/wp-content/plugins/insert-php/ Vendor Homepage: https://fr.wordpress.org/plugins/insert-php/ Tested on: MSWin32 Version: 3.3.1 Explanation :...

Smith - A Very Quick And Very Dirty Client/Server Tool For Testing Firewalls

A client/server style agent meant for testing connectivity to and from a machine on a network. Installation python setup.py install or pip install . should install smith. Note: If you want to use the tcp/udp protocol options, you'll need to install scapy and it's dependencies. Ubuntu has 'apt-get...

WordPress wp-json Content Injection

!/bin/bash Wordpress wpJson API exploit Larry W. Cashdollar Discovered by Marc Montipas http://www.vapidlabs.com/exploits/wordpressexploit.sh.txt https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html?utmcampaign=wp472vuln Usage ./exp.sh target 1 or 2 if $2 == 2...

Thousands of WordPress Sites Hacked Using Recently Disclosed Vulnerability

Last week, we reported about a critical zero-day flaw in WordPress that was silently patched by the company before hackers have had their hands on the nasty bug to exploit millions of WordPress websites. To ensure the security of millions of websites and its users, WordPress delayed the...

WordPress REST API content injection vulnerability analysis-vulnerability warning-the black bar safety net

Author: Lucifaer 0x00 vulnerability description 1. Vulnerability description In the REST API automatically included in Wordpress4. 7 or more version, the WordPress REST API provides a set of easy-to-use HTTP endpoint, you can use the user in a simple JSON format to access the site's data,...

WordPress REST API Content Injection

This module exploits a content injection vulnerability in WordPress versions 4.7 and 4.7.1 via type juggling in the REST API. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress REST API...

WordPress REST API Plugin Content Injection Vulnerability

WordPress is a free and open source blogging software and content management system that uses PHP and MySQL as its platform. A content injection vulnerability exists in the WordPress REST API plugin. A remote attacker can exploit the vulnerability to elevate privileges or perform content injectio...

IBM UrbanCode Deploy Multiple Vulnerabilities

IBM UrbanCode Deploy is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ibm:urbancodedeploy"; ...

WordPress Silently Fixed Privilege Escalation Vulnerability in 4.72 Update

WordPress silently fixed a serious content injection vulnerability when it pushed out its latest security release, 4.7.2, last week. Sucuri, the firm that found the vulnerability, disclosed it Wednesday and said that if exploited, it could have let an attacker modify the content of any WordPress...