CVE-2014-9016
Drupal 7.x < 7.34 and Secure Password Hashes 6.x-2.x < 6.x-2.1 - Denial of Service via Password Hashing API
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2014-9016.
PoCs published by Javer Nieto & Andres Rojas, c0r3dump3d, Primus27, including Metasploit module auxiliary/dos/http/wordpress_long_password_dos.
AI-analyzed exploit summary This exploit demonstrates a denial-of-service (DoS) vulnerability in Drupal < 7.34 by sending specially crafted requests with a large payload to exhaust CPU and memory resources. The PoC uses a valid user login request with an excessively long password field to trigger the vulnerability.
Description
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
Exploits (4)
This exploit demonstrates a denial-of-service (DoS) vulnerability in Drupal < 7.34 by sending specially crafted requests with a large payload to exhaust CPU and memory resources. The PoC uses a valid user login request with an excessively long password field to trigger the vulnerability.
This repository contains a Python script that exploits CVE-2014-9016, a timing attack vulnerability in Drupal 6.* (with phpass module) and 7.* for user enumeration. The script can also attempt a DoS attack by flooding the server with login requests.
This repository contains a functional proof-of-concept exploit for CVE-2014-9016, a denial-of-service vulnerability in WordPress versions prior to 5.0.1. The exploit automates the submission of excessively long passwords to the WordPress login page, causing the service to become unresponsive.
This Metasploit module exploits CVE-2014-9016 by sending multiple login requests with an extremely long password to WordPress, causing excessive CPU consumption due to improper password hashing. The module validates the target username and executes concurrent requests to amplify the DoS effect.