Ok Crybabies: 2.8.3 wordpress remote admin password exploit - GoFuckYourself.com

fris · 08-11-2009, 08:48 AM

Before you make posts saying shit please understand this exploit before you go all bananas.

You can reset the admin password without confirmation, but you dont know the password, and unless you have access to the admin email account it does nothing.

http://www.milw0rm.com/exploits/9410

Proof of concept

Quote:

http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]=

Already a fix out, so dont cry about having to upgrade all the time, if you dont like the product, dont use it, simple.

fix, edit 1 line of the code

http://core.trac.wordpress.org/changeset/11798

CurrentlySober · 08-11-2009, 08:53 AM

I FUCKIN HATE... Poppy Morgan..

Iron Fist · 08-11-2009, 09:01 AM

So since you can't actually get access, how is this an exploit? Other than pissing off the admin of the site with constant e-mails that his admin password changed.

I can see how this could be annoying however.

Robocrop · 08-11-2009, 09:02 AM

Great news Fris.

Hentaikid · 08-11-2009, 10:32 AM

Another reason to delete admin user and use a different username as admin

tonyparra · 08-11-2009, 12:19 PM

Quote:

Originally Posted by fris

Before you make posts saying shit please understand this exploit before you go all bananas.

You can reset the admin password without confirmation, but you dont know the password, and unless you have access to the admin email account it does nothing.

http://www.milw0rm.com/exploits/9410

Proof of concept

Already a fix out, so dont cry about having to upgrade all the time, if you dont like the product, dont use it, simple.

fix, edit 1 line of the code

http://core.trac.wordpress.org/changeset/11798

I dont use admin on any wordpress site

tonyparra · 08-11-2009, 12:21 PM

Quote:

Originally Posted by fris

Before you make posts saying shit please understand this exploit before you go all bananas.

You can reset the admin password without confirmation, but you dont know the password, and unless you have access to the admin email account it does nothing.

http://www.milw0rm.com/exploits/9410

Proof of concept

Already a fix out, so dont cry about having to upgrade all the time, if you dont like the product, dont use it, simple.

fix, edit 1 line of the code

http://core.trac.wordpress.org/changeset/11798

also mr. fris why so serious lets drink man

The Duck · 08-11-2009, 12:22 PM

Also htaccess protect your admin folder.

TheSenator · 08-11-2009, 01:15 PM

fixed.....thanks

fris · 08-11-2009, 02:29 PM

remember it only resets your admin password without confirmation, theirs no way you can know the admin password unless you have access to the admin email, so its not really a exploit, just really unconveinent, cause people will be resettting password, but like i said its fixed.

08-11-2009, 08:53 AM	#2
CurrentlySober Too lazy to wipe my ass Industry Role: Join Date: Aug 2002 Location: A Public Bathroom Posts: 38,485	I FUCKIN HATE... Poppy Morgan.. __________________ My AI Handywork... My Dream Gal... XXX 👁️ 👍️ 💩

08-11-2009, 09:01 AM	#3
Iron Fist Too lazy to set a custom title Join Date: Dec 2006 Posts: 23,400	So since you can't actually get access, how is this an exploit? Other than pissing off the admin of the site with constant e-mails that his admin password changed. I can see how this could be annoying however. __________________ i like waffles

08-11-2009, 12:22 PM	#8
The Duck Adult Content Provider Industry Role: Join Date: May 2005 Location: Europe Posts: 18,243	Also htaccess protect your admin folder. __________________ Skype Horusmaia ICQ 41555245 Email [email protected]

08-11-2009, 01:15 PM	#9
TheSenator Too lazy to set a custom title Industry Role: Join Date: Feb 2003 Location: NJ Posts: 13,331	fixed.....thanks __________________ ISeekGirls.com since 2005

08-11-2009, 02:29 PM	#10
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,212	remember it only resets your admin password without confirmation, theirs no way you can know the admin password unless you have access to the admin email, so its not really a exploit, just really unconveinent, cause people will be resettting password, but like i said its fixed. __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

08-11-2009, 09:02 AM	#4
Robocrop Confirmed User Industry Role: Join Date: Aug 2008 Location: Hollywood Posts: 2,785	Great news Fris.

08-11-2009, 10:32 AM	#5
Hentaikid Confirmed User Join Date: Nov 2002 Posts: 1,249	Another reason to delete admin user and use a different username as admin