WordPress 2.6.1 SQL Column Truncation Vulnerability分析

最新推荐文章于 2025-11-25 13:06:55 发布

原创最新推荐文章于 2025-11-25 13:06:55 发布 · 490 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#wordpress #sql #email #database #go #login

本文介绍了一种WordPress 2.6.1版本中存在的SQL列截断漏洞利用方法，通过该方法攻击者可以远程更改管理员密码。漏洞发现者详细描述了利用步骤：首先注册一个与管理员同名的账号，然后通过找回密码流程来尝试修改原始管理员的密码。

# WordPress 2.6.1 SQL Column Truncation Vulnerability (PoC)
#
# found by irk4z[at]yahoo.pl
# homepage: http://irk4z.wordpress.com/
#
# this is not critical vuln [;
#
# first, read this discovery:
# http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/
#
# in this hack we can remote change admin password, if registration enabled
#
# greets: Stefan Esser, Lukasz Pilorz, cOndemned, tbh, sid.psycho, str0ke and all fiends

1. go to url: server.com/wp-login.php?action=register

2. register as:

now, we have duplicated 'admin' account in database

3. go to url: server.com/wp-login.php?action=lostpassword

4. write your email into field and submit this form

5. check your email and go to reset confirmation link

6. admin's password changed, but new password will be send to correct admin email ;/