CVE-2024-1813 - Simple Job Board ≤ 2.11.0 (WordPress) - Unauthenticated PHP Object Injection

🎥 Proof-of-Concept demo

End-to-end: a guest stores a serialized PHP object through the public application form, the admin opens the applicants list, and the gadget chain drops a webshell.

Unauthenticated PHP Object Injection in the Simple Job Board WordPress plugin (PressTigers). A guest stores a serialized PHP object through the public application form; when an admin later opens the applicants list, the plugin unserializes it and a third-party gadget chain turns it into remote code execution.

📖 Full technical write-up: https://mobeta.fr/blog/

This repository is the companion lab and PoC. The detailed analysis (root cause, the double unserialize, building the POP chain, WAF bypass) lives in the blog post.

Requirements

• Python 3.7+ for the PoC - standard library only, no packages to install.
• Docker + Docker Compose for the lab.

Repository layout

.
├── sjb_cve_2024_1813.py     # the PoC (builds + sends the payload)
├── LICENSE
└── lab/
    ├── docker-compose.yml   # WordPress + MariaDB + vulnerable plugins
    ├── setup/setup.sh        # one-shot provisioning (wp-cli)
    └── trigger_exploit.sh    # simulates the admin opening the applicants list

Lab

Reproduces the vulnerable stack: WordPress 6.9.4 / PHP 8.3 / MariaDB 10.11 with Simple Job Board 2.10.8 (source + sink) and All In One SEO 4.5.6 (the gadget chain).

cd lab
docker compose up -d            # boot + auto-provision
docker compose logs setup       # prints the site URL, admin creds and job_id

Lab defaults: http://localhost:8081, admin admin / admin123!.

Run the exploit

# 1. Store the payload (pre-auth). Replace 4 with the job_id from the setup logs.
python3 sjb_cve_2024_1813.py http://localhost:8081 4 'id > /tmp/RCE_PROOF.txt'

# 2. Fire the sink (plays the admin opening the applicants list).
cd lab && ./trigger_exploit.sh

# 3. Check the result.
docker exec sjb_lab_wp cat /tmp/RCE_PROOF.txt

Useful PoC flags:

• --print-only - build and print the wire payload, no network traffic.
• --field - POST field name (must contain name; default jobapp_full_name).
• --int-prefix '+' - WAF-evasion variant of the serialized length prefix.
• --proxy http://127.0.0.1:8080 - route through Burp.

Mitigation

• Update Simple Job Board to ≥ 2.11.1.
• Audit any explicit unserialize() / maybe_unserialize() on post_meta; prefer unserialize($data, ['allowed_classes' => false]).
• Block direct access to vendor/composer/installed.json so scoped library versions cannot be fingerprinted.
• Remove unused plugins that expose POP gadgets (Monolog, Guzzle, Symfony, …).

References

• WPScan: https://wpscan.com/vulnerability/600cb9cf-2e93-4927-b449-edd7edf186d2/
• Wordfence: https://www.wordfence.com/threat-intel/vulnerabilities/id/89584034-4a93-42a6-8fef-55dc3895c45c
• SVN patch diff 2.10.8 → 2.11.1: https://plugins.trac.wordpress.org/changeset?new=3051715%40simple-job-board&old=3038476%40simple-job-board
• PHPGGC (Monolog chains): https://github.com/ambionics/phpggc

Disclaimer

For authorized security testing and education only. Never run this against any system without explicit written permission from its owner.

License

MIT - see LICENSE.