Exploitation Summary
EIP tracks 3 public exploits for CVE-2014-9034.
PoCs published by Javer Nieto & Andres Rojas, SECURELI.com, Javier Nieto Arevalo, Andres Rojas Guerrero, rastating, including Metasploit module auxiliary/dos/http/wordpress_long_password_dos.
AI-analyzed exploit summary This exploit demonstrates a denial-of-service (DoS) vulnerability in WordPress versions prior to 4.0.1 by sending a large payload to the login endpoint, causing CPU and memory exhaustion. The PoC uses a crafted request with an excessively long password field to overwhelm the server.
Description
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
Exploits (3)
This exploit demonstrates a denial-of-service (DoS) vulnerability in WordPress versions prior to 4.0.1 by sending a large payload to the login endpoint, causing CPU and memory exhaustion. The PoC uses a crafted request with an excessively long password field to overwhelm the server.
This PoC exploits a DoS vulnerability in WordPress <= v4.0 by sending multiple POST requests with an excessively long password field, causing resource exhaustion. It uses cURL multi-handling to simulate concurrent requests.
This Metasploit module exploits CVE-2014-9034, a DoS vulnerability in WordPress caused by improper handling of long passwords during hashing. It sends multiple login requests with extremely long passwords to consume CPU resources.