CVEs-PoC/2016/CVE-2016-1209.md

CVE-2016-1209

Description

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.

POC

Reference

• http://packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html
• http://packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html
• http://www.pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilities
• http://www.pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilities
• https://wpvulndb.com/vulnerabilities/8485
• https://wpvulndb.com/vulnerabilities/8485

Github

• https://github.com/ACIC-Africa/metasploitable3
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Karma47/Cybersecurity_base_project_2
• https://github.com/bharathkanne/csb-2
• https://github.com/maasikai/cybersecuritybase-project-2