CVE-2009-2762
WordPress < 2.8.3 - Unauthenticated Password Reset via Array Parameter Bypass
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2009-2762. PoCs published by laurent gaffié, iso^kpsbr, irk4z.
AI-analyzed exploit summary This is a vulnerability writeup for CVE-2009-2762, detailing an authentication bypass in WordPress <= 2.8.3 that allows an attacker to reset the admin password by submitting an array to the key variable.
Description
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Exploits (3)
This is a vulnerability writeup for CVE-2009-2762, detailing an authentication bypass in WordPress <= 2.8.3 that allows an attacker to reset the admin password by submitting an array to the key variable.
This exploit targets a vulnerability in WordPress 2.6.1 to take over the admin account by abusing the password reset mechanism and predicting the random seed used for password generation. It registers a new admin user, triggers a password reset, and brute-forces the seed to compute the new password.
This exploit leverages SQL column truncation in WordPress 2.6.1 to create a duplicate admin account by registering a username with trailing spaces, allowing password reset via the lost password feature.