{"uuid": "8b761260-a813-4296-89d5-61a095bb936e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "seen", "source": "https://gist.github.com/mifzal/d9fd47a41c5747434f037a4c235d1758", "content": "#!/usr/bin/env bash\n# University of Washington CVE-2026-93485 disclosure \u2014 passive-only evidence playback\n# LIVE=1 bash UW_Engagement_Playback.sh \u2192 re-run passive fingerprinting (GET only)\ncd /mnt/d/bantai1/comment2shell || exit 1\nLIVE=${LIVE:-0}\nHOSTS=\"www.radonc.washington.edu radonc.washington.edu www.radiationoncology.washington.edu radiationoncology.washington.edu www.uwcc.washington.edu\"\nTARGET=\"radiationoncology.uw.edu\"\nbanner(){ echo; echo \"\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\"; echo \"  $1\"; echo \"\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\"; }\n\nbanner \"EVIDENCE 1/4 \u2014 PASSIVE DETECTION: WordPress 7.1.0 on $TARGET\"\necho \"All legacy hostnames redirect to this single instance:\"\nfor h in $HOSTS; do\n  printf \"  %-45s -> %s\\n\" \"$h\" \"$(curl -skL -o /dev/null -w '%{url_effective}' -A 'Mozilla/5.0' \"https://$h/\" 2>/dev/null)\"\ndone\necho; echo \"Generator meta (from $TARGET):\"\nif [ \"$LIVE\" = 1 ]; then\n  curl -skL -m 15 -A 'Mozilla/5.0' \"https://$TARGET/\" | grep -oiE ']*>' | head -1\nelse\n  d=$(ls -d disclosure/uw/radonc.washington.edu_* 2>/dev/null | sort | tail -1)\n  head -1 \"$d/generator.txt\" 2>/dev/null || echo \"(absent)\"\nfi\n\nbanner \"EVIDENCE 2/4 \u2014 THREE INDEPENDENT WITNESSES (gen/feed/verparams)\"\nd=$(ls -d disclosure/uw/radonc.washington.edu_* 2>/dev/null | sort | tail -1)\necho \"From $TARGET (captured via radonc.washington.edu):\"\necho \"  gen  : $(head -1 $d/generator.txt 2>/dev/null || echo '(absent)')\"\necho \"  feed : $(head -1 $d/feed_gen.txt 2>/dev/null || echo '(absent)')\"\necho \"  ver  :\"\ngrep -h 'ver=7.1' $d/verparams.txt 2>/dev/null | head -2 | sed 's/^/         /'\n\nbanner \"EVIDENCE 3/4 \u2014 INTEGRITY: SHA-256 VERIFICATION\"\necho \"\u2500\u2500 radonc.washington.edu (representative capture)\"\nd=$(ls -d disclosure/uw/radonc.washington.edu_* 2>/dev/null | sort | tail -1)\n( cd \"$d\" && sha256sum -c hashes.sha256 ) 2>/dev/null || echo \"(hash file not found)\"\necho; echo \"Hash consistency check (all legacy hostnames serve identical content):\"\nsha256sum disclosure/uw/*_20260930T004410Z/home.html 2>/dev/null | awk '{print \"  \" $1 \"  \" $2}'\n\nbanner \"EVIDENCE 4/4 \u2014 VERDICT: 1 INSTANCE / 5 LEGACY HOSTNAMES = LIKELY VULNERABLE\"\nprintf \"%-35s %-8s %s\\n\" \"INSTANCE\" \"VERSION\" \"STATUS\"\nprintf \"%-35s %-8s %s\\n\" \"$TARGET\" \"7.1.0\" \"LIKELY VULNERABLE (CVE-2026-93485)\"\necho; echo \"Accessible via legacy hostnames:\"\nfor h in $HOSTS; do printf \"  %s\\n\" \"$h\"; done\necho; echo \"Methodology: Passive fingerprinting only (public GET, redirects followed). No exploitation.\"\necho \"Reproduction: Isolated Docker laboratory (wordpress:7.1.0 image).\"\necho \"Safe Harbor: Consistent with CFAA safe harbor principles and UW CISO reporting guidance.\"\n", "creation_timestamp": "2026-09-30T02:22:27.000000Z"}