Erwan erwanlr

While investigating an IDOR issue in the Home Sweet premium theme, allowing arbitrary deletion of Ads, the Realia plugin was found to be the root cause.

In fact, having this plugin installed (which some themes require) can allow unauthenticated attackers to delete arbitrary posts, by submitting a malicious request with the post ID to delete.

In includes/class-realia-submission.php

add_action( 'init', array( __CLASS__, 'process_remove_form' ), 9999 );
[...]
public static function process_remove_form() {
  if ( ! isset( $_POST['remove_property_form'] ) || empty( $_POST['property_id'] ) ) {

	source "http://rubygems.org"

	gem 'typhoeus', '>=0.6.2'
	#gem 'typhoeus', :git => 'git://github.com/typhoeus/typhoeus.git'
	gem 'webmock', '>=1.9.3'
	gem 'rspec', :require => 'spec'

	#!/usr/bin/env ruby

	require 'rubygems'
	require 'typhoeus'
	require 'webmock'

	include WebMock::API

	module WebMock
	class StubRegistry

	$ hydra -dvv -t 2 -l admin -p admin -V 192.168.1.103 http-form-get "/test.php:log=^USER^&pwd=^PASS^&testcookie=1:incorrect"
	Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

	[DEBUG] Ouput color flag is 1
	Hydra (http://www.thc.org/thc-hydra) starting at 2015-06-27 20:23:46
	[DEBUG] cmdline: hydra -dvv -t 2 -l admin -p admin -V 192.168.1.103 http-form-get /test.php:log=^USER^&pwd=^PASS^&testcookie=1:incorrect
	[VERBOSE] More tasks defined than login/pass pairs exist. Tasks reduced to 1
	[DATA] max 1 task per 1 server, overall 64 tasks, 1 login try (l:1/p:1), ~0 tries per task
	[DATA] attacking service http-get-form on port 80
	[VERBOSE] Resolving addresses ...

	require 'rspec'
	require 'optparse'

	module Test
	class Error < StandardError
	end

	class AnotherError < Error
	def to_s
	'this message exactly'