@@ -16,16 +16,16 @@ def initialize(info = {})
16
16
super ( update_info ( info ,
17
17
'Name' => 'Wordpress W3 Total Cache PHP Code Execution' ,
18
18
'Description' => %q{
19
- This module exploits a PHP Code Injection vulnerability on the W3 Total Cache
20
- wordpress plugin up to and including 0.9.2.8 version. Versions up to and including
21
- 1.2 of WP Super Cache plugin are also reported as vulnerable. The exploit is due to
22
- the handle of some special macros, such as mfunc, which allow to inject arbitrary
23
- PHP code. A valid post id where publish the malicious comment is needed. The user
24
- can provide it with the POSTID option, otherwise a valid one will try to be brute
25
- forced. Also, if anonymous comments aren't allowed, valid credentials must be
26
- provided. Finally, comments shouldn't be moderated in order finish the exploitation
27
- successfully. This module has been tested against Wordpress 3.5 and W3 Total Cache
28
- 0.9.2.3 on a Ubuntu 10.04 system.
19
+ This module exploits a PHP Code Injection vulnerability against Wordpress plugin
20
+ W3 Total Cache for version up to and including 0.9.2.8. WP Super Cache 1.2 or older
21
+ is also reported as vulnerable. The vulnerability is due to the handling of certain
22
+ macros such as mfunc, which allows arbitrary PHP code injection. A valid post ID is
23
+ needed in order to add the malicious comment. If the POSTID option isn't specified,
24
+ then the module will automatically brute-force one. Also, if anonymous comments
25
+ aren't allowed, then a valid username and password must be provided. In addition,
26
+ the "A comment is held for moderation" option on Wordpress must be unchecked for
27
+ successful exploitation. This module has been tested against Wordpress 3.5 and
28
+ W3 Total Cache 0.9.2.3 on a Ubuntu 10.04 system.
29
29
} ,
30
30
'Author' =>
31
31
[
@@ -198,7 +198,7 @@ def exploit
198
198
random_test = rand_text_alpha ( 64 )
199
199
@sum = Rex ::Text . sha1 ( random_test )
200
200
201
- print_status ( "#{ peer } - Injecting the PHP Code throw a comment..." )
201
+ print_status ( "#{ peer } - Injecting the PHP Code in a comment..." )
202
202
post_uri = post_comment
203
203
if post_uri . nil?
204
204
fail_with ( Exploit ::Failure ::Unknown , "#{ peer } - Expected redirection not returned" )
0 commit comments