 |
Next, we will explain the results of the detected Wordpress article tampering vulnerabilities.
No. 5 detection is conducted for endpoints that require authentication and need to set parameters.
In this evaluation experiment, we successfully detected the vulnerability in the POST method /wp/v2/posts/{id}.
In No.5, the vulnerability assessment is conducted by replacing and combining parameters.
For the original parameters to be replaced or combined, use the same data for each parameter for each endpoint saved in the previous step.
In the case of /posts/{id}, the parameters used are "38" for ID and "ArticleName" for Title.
For these parameters, for {id}, which receives a numeric value, replace "38" in the ID with "A" since we are using "A" in this presentation, and combine "38" and "A" to make "38A".
We only use "A" as an any-string because the purpose of this method is to change the value to a value of a different type and not to focus on the content of the string.
Next, for the Title, which receives a string, replace "ArticleName" in the Title with "1" since we are using "1" in this presentation, and combine "ArticleName" with "1" to make "ArticleName1".
As a result of these parameter replacements and combinations, the HTTP status code of the response to the request with the {id} of "38A" and the Title of "ArticleName" was 200 OK, indicating that the request was processed normally.
Therefore, we detected that /posts/{id} is vulnerable to No. 5, which allows processing to bypass authentication under the condition in the second row of the table. |
IEEE/ICACT20220047 Slide.20
[Big Slide]