-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Wordpress plugin: Email Subscribers & Newsletters sqli (CVE-2019-20361) #14418
Conversation
end | ||
|
||
checkcode = check_plugin_version_from_readme('email-subscribers', '4.3.1') | ||
if checkcode == Msf::Exploit::CheckCode::Safe |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks like the logic from check_plugin_version_from_readme
can also return Appears, Detected and Unknown under some conditions. Continuing on Vulnerable, Appears and Detected like AutoCheck
mixin does would be a bit more robust here.
print_good('Vulnerable version detected') | ||
|
||
guid = Rex::Text.rand_guid | ||
email = "#{Rex::Text.rand_text_alpha(8)}@#{Rex::Text.rand_text_alpha(8)}.com" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So turns out Rex text actually has a builtin method for this: Rex::Text.rand_mail_address
.
looks good, retested and working! |
Works as intended, I'll get this landed. Tested with Testing Output
|
Release NotesNew module |
While I am executing this module, I am getting this error. Can anybody tell what is wrong? msf6 auxiliary(scanner/http/wp_email_sub_news_sqli) > exploit [] Checking /wordpress5.4/wp-content/plugins/email-subscribers/readme.txt |
I tried increasing the SQLidelay to 10, but the error persists. |
What db? |
This PR adds a module and docs for CVE-2019-20361, a time based sqli in wordpress plugin Email Subscribers & Newsletters < 4.3.1
Verification
use auxiliary/scanner/http/wp_email_sub_news_sqli
set rhosts [ip]
set action [action]
run