CVE-2019-9787 PoC — WordPress 跨站请求伪造漏洞

Source

https://github.com/dexXxed/CVE-2019-9787

Associated Vulnerability

Title:WordPress 跨站请求伪造漏洞 (CVE-2019-9787)
Description:WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.

Description

Overview PoC of CSRF CVE-2019-9787 WordPress Version 5.1.1

Readme

# CVE-2019-9787 CSRF PoC

## Overview
PoC of CSRF CVE-2019-9787
WordPress Version 5.1.1
[CVE-2019-9787](https://blog.ripstech.com/2019/wordpress-csrf-to-rce/)

Do not use this, EXCEPT for TEST purpose.

## Installation

```
docker-compose up -d
```

## Attack

1. Access http://localhost:8080/wp-admin/install.php and install WordPress. you only have to create WP admin account.

<p align="center">
  <img width="547" height="637" src="./screenshots/1.JPG">
</p>

2. Access http://localhost:8080/?p=1#comments as a visitor, and post comment like "Hacker Attack http://localhost/".

<p align="center">
  <img width="796" height="460" src="./screenshots/2.JPG">
</p>

<p align="center">
  <img width="711" height="642" src="./screenshots/3.JPG">
</p>

<p align="center">
  <img width="674" height="240" src="./screenshots/4.JPG">
</p>

3. Click the link posted at 2.

<p align="center">
  <img width="1206" height="131" src="./screenshots/5.JPG">
</p>

<p align="center">
  <img width="539" height="128" src="./screenshots/6.JPG">
</p>


4. You will see the comment "CSRF Attack made Successfully!" is posted by user you currently logged in.

<p align="center">
  <img width="1178" height="122" src="./screenshots/7.JPG">
</p>

<p align="center">
  <img width="665" height="459" src="./screenshots/8.JPG">
</p>

File Snapshot


 [4.0K]  /data/pocs/e75aecdc4508167a7836143dcdd6af99d3a44e72
├── [ 690]  docker-compose.yml
├── [4.0K]  nginx
│   ├── [ 282]  iframe-post.html
│   └── [ 153]  index.html
├── [1.3K]  README.md
└── [4.0K]  screenshots
    ├── [ 32K]  1.JPG
    ├── [ 33K]  2.JPG
    ├── [ 40K]  3.JPG
    ├── [ 19K]  4.JPG
    ├── [ 22K]  5.JPG
    ├── [ 17K]  6.JPG
    ├── [ 21K]  7.JPG
    └── [ 40K]  8.JPG

2 directories, 12 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!