CVE-2016-6897
MEDIUMWordPress < 4.5.5 - Cross-Site Request Forgery via Late check_ajax_referer Call
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2016-6897.
PoCs published by Yorick Koster, Yorick Koster, CryptisStudents, including Metasploit module auxiliary/dos/http/wordpress_directory_traversal_dos.
AI-analyzed exploit summary The exploit demonstrates a path traversal vulnerability in WordPress Core Ajax handlers, specifically in the wp_ajax_update_plugin() function. It allows an authenticated user (Subscriber) to trigger a denial of service (DoS) by exhausting the entropy pool via repeated reads from /dev/random.
Description
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Exploits (2)
The exploit demonstrates a path traversal vulnerability in WordPress Core Ajax handlers, specifically in the wp_ajax_update_plugin() function. It allows an authenticated user (Subscriber) to trigger a denial of service (DoS) by exhausting the entropy pool via repeated reads from /dev/random.
This Metasploit module exploits a CSRF vulnerability in WordPress before 4.6, allowing authenticated attackers to trigger a DoS by sending multiple requests to read /dev/random via path traversal in the update-plugin action.
References (7)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N