exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Rory M

WordPress 5.3 Denial Of Service

Posted Jan 14, 2020

Authored by Rory M | Site labs.arcturus.net

WordPress is vulnerable to denial of service by abusing XMLRPC API. The system.multicall function lets you batch other API calls. Another API function is pingback.ping, which makes WordPress make a connection out to another site. If you batch a few thousand pingback.ping requests using the multicall feature, you can exhaust a variety of different resources on the server. This PoC will eat through Apache2's worker threads and will also make MySQL eat up more CPU and mem, possibly knocking over low-RAM VPS instances.

tags | exploit, denial of service

SHA-256 | 6c6fe7a9f5127e081592602ad3e160fb880556efc026bfde16f893df42e1b79d

Download | Favorite | View