Sploitus

Exploit for Cross-Site Request Forgery (CSRF) in Wordpress

CVE-2019-9787

githubexploit · 2021-06-29

Exploit Code

README50 lines
## https://sploitus.com/exploit?id=DA9C0190-F310-53CF-BE07-677788D62F44
# CVE-2019-9787 CSRF PoC

## Overview
PoC of CSRF CVE-2019-9787
WordPress Version 5.1.1
[CVE-2019-9787](https://blog.ripstech.com/2019/wordpress-csrf-to-rce/)

Do not use this, EXCEPT for TEST purpose.

## Installation

```
docker-compose up -d
```

## Attack

1. Access http://localhost:8080/wp-admin/install.php and install WordPress. you only have to create WP admin account.


  


2. Access http://localhost:8080/?p=1#comments as a visitor, and post comment like "Hacker Attack http://localhost/".


  



  



  


3. Click the link posted at 2.


  



  



4. You will see the comment "CSRF Attack made Successfully!" is posted by user you currently logged in.