Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: October 21, 2025 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 308 Members: 0 Total: 308 Full disclosure Google Firebase hosting suspension / "malware distribution"bypass CyberDanube Security Research 20251014-0 | Multiple Vulnerabilities in Phoenix Contact QUINT4 UPS apis.google.com - Insecure redirect via __lu parameter(exploited in the wild) Urgent Security Vulnerabilities Discovered in Mercku Routers Model M6a Re: Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS) Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS) [SBA-ADV-20250730-01] CVE-2025-39664: Checkmk Path Traversal [SBA-ADV-20250724-01] CVE-2025-32919: Checkmk Agent Privilege Escalation via Insecure Temporary Files CVE-2025-59397 - Open Web Analytics SQL Injection Re: [FD]Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft Re: Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft Re: Defense in depth -- the Microsoft way (part 93): SRP/SAFERwhitelisting goes black on Windows 11 Re: [FD]: "Glass Cage" – Zero-Click iMessage ? Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885) Re: [FD]Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain ? Secure Enclave Key Theft, Wormable RCE, Crypto Theft Samtools v1.22.1 Uncontrolled Memory Allocation from Large BED Intervals Causes Denial-of-Service in Samtools/HTSlib IT Security and Insecurity Portal www.waraxe.us Forum Index -> All other software -> Wordpress 2.5 Cookie Integrity Protection Vulnerability View previous topic :: View next topic Wordpress 2.5 Cookie Integrity Protection Vulnerability Posted: Fri Apr 25, 2008 8:40 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Just found this interesting Wordpress exploit: http://packetstormsecurity.org/0804-advisories/wordpress-cookie-integrity.txt Code: Wordpress 2.5 Cookie Integrity Protection Vulnerability Original release date: 2008-04-25 Last revised: 2008-04-25 Latest version: http://www.cl.cam.ac.uk/users/sjm217/advisories/wordpress-cookie-integrity.txt CVE ID: CVE-2008-1930 Source: Steven J. Murdoch <http://www.cl.cam.ac.uk/users/sjm217/> Systems Affected: Wordpress 2.5 Overview: An attacker, who is able to register a specially crafted username on a Wordpress 2.5 installation, is able to generate authentication cookies for other chosen accounts. This vulnerability exists because it is possible to modify authentication cookies without invalidating the cryptographic integrity protection. If a Wordpress blog is configured to freely permit account creation, a remote attacker can gain Wordpress-administrator access and then elevate this to arbitrary code execution as the web server user. The vulnerability is fixed in Wordpress 2.5.1 I. Description Since version 2.5, Wordpress authenticates logged-in users through a cryptographically protected cookie, based on papers by Fu et al [1] and Liu et al [2]. This measure was introduced partly in response to vulnerability CVE-2007-6013 [3,4]. The new cookies are of the form: "wordpress_".COOKIEHASH = USERNAME . "|" . EXPIRY_TIME . "|" . MAC Where: COOKIEHASH: MD5 hash of the site URL (to maintain cookie uniqueness) USERNAME: The username for the authenticated user EXPIRY_TIME: When cookie should expire, in seconds since start of epoch MAC: HMAC-MD5(USERNAME . EXPIRY_TIME) under a key derived from a secret and USERNAME . EXPIRY_TIME. The flaw in this scheme is that USERNAME and EXPIRY_TIME are not delimited in the MAC calculation. Hence the cookie may be modified, without altering MAC, provided that the concatenation of USERNAME and EXPIRY_TIME remains unchanged. This class of vulnerability, the cryptographic splicing attack, was commented on by Fu et al [1], but Wordpress does not employ their recommended defence. An attacker wishing to exploit this vulnerability would therefore create an unprivileged account with its username starting with "admin". The cookie returned on logging into this account can then be manipulated so as to be valid for the administrator account. II. Impact A remote attacker, who can create an account with specially crafted username, is able to gain administrator level access to the Wordpress installation. Through standard techniques, this can be escalated to arbitrary PHP code execution as the web server system user. III. Solution Upgrade to Wordpress 2.5.1 Workarounds: - De-select "Anyone can register" in the Membership section of General Settings to disable account creation. References: [1] Dos and Don'ts of Client Authentication on the Web, Kevin Fu, Emil Sit, Kendra Smith, Nick Feamster http://pdos.csail.mit.edu/papers/webauth:tr.pdf [2] A Secure Cookie Protocol, Alex X. Liu, Jason M. Kovacs, Chin-Tser Huang, Mohamed G. Gouda http://www.cse.msu.edu/~alexliu/publications/Cookie/cookie.pdf [3] Wordpress Cookie Authentication Vulnerability: CVE-2007-6013 Steven J. Murdoch, http://www.cl.cam.ac.uk/users/sjm217/advisories/wordpress-cookie-auth.txt [4] http://trac.wordpress.org/ticket/5367 Timeline: 2008-04-22: security@wordpress.com notified Confirmation of receipt received 2008-04-25: Wordpress 2.5.1 released incorporating patch Vulnerability notice published -- w: http://www.cl.cam.ac.uk/users/sjm217/ Posted: Sat Apr 26, 2008 7:27 am pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria Лучше б PoC написали,а то создать юзера блабла мне ниче толково не дает.Иначе я ет читал нескока дней назад.waraxe какие нибуть идеи?У меня уже бъло счастье попасть в админку версии 2.5.Девелоперъй из вордпресса сделали заливание пхп кода есчо проще. Posted: Sat Apr 26, 2008 12:51 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu I have not tested this yet, no enough free time Wordpress 2.5 Cookie Integrity Protection Vulnerability www.waraxe.us Forum Index -> All other software You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

PCWizardHub - Helping you fix, build, and optimize your PC life
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.035 Seconds