Exploitation-of-a-Remote-Code-Execution-vulnerability--CVE-2024-7954-

Exploitation of a Remote Code Execution vulnerability- (CVE-2024-7954)

2. Vulnerability Description

The porte_plume plugin (before versions 4.30-alpha2, 4.2.13, 4.1.16) is vulnerable due to insufficient sanitization of user-provided input. Attackers can inject PHP code into specific form fields which is later rendered and executed by the server.

Impact: Unauthenticated Remote Code Execution Severity: Critical Attack Vector: Network / HTTP POST

3. Proof of Concept (PoC)

Malicious POST Request

Notes

• PHP code is injected inside the markdown formatting engine.
• Executed as the SPIP user on the server.
• Attack requires no authentication.

4. FOFA Reconnaissance

A FOFA query was used to enumerate public SPIP installations:

FOFA returned multiple metadata points:

• HTTP headers
• Titles
• IP addresses & geolocation
• Server technology stack

Recon Value

1. Target Enumeration: Identify reachable SPIP CMS servers.
2. Version Fingerprinting: Determine if vulnerable plugin versions are active.
3. Prioritization: Select likely exploitable systems.
4. Exploit Verification: Validate endpoints using controlled payloads.
5. Automation: Export FOFA results into targets.txt for batch scanning.

A suitable real-world host identified:

5. Automated Scanning with Nuclei

Purpose

Since manual exploitation is slow, Nuclei was used to automate detection of CVE-2024-7954 across a large set of targets.

Command (Custom Template)

• -l targets.txt loads FOFA results
• -t loads custom PoC template

Note: Initial template returned no matches.

Broad CVE Scan

This scan identified one responsive target:

6. Manual Validation & Exploitation

Step 1 — Inspect Vulnerable Endpoint

Visit:

Confirmed:

• Input fields for name, email, message
• POST request handler suitable for payload injection

Step 2 — Inject PHP Payload

Using Burp Suite or curl, modify the message parameter:

Payload

Step 3 — Trigger Command Execution

Visit:

Or using curl:

Output confirmed remote command execution.

Step 4 — Reverse Shell (Final Access)

A crafted payload enables a reverse shell callback, allowing:

• whoami
• ls
• full interactive shell access

7. Critical Observations

• Unauthenticated exploit increases severity dramatically.
• Input sanitization failure in the plugin is the core issue.
• Once PHP is injected and rendered, complete server compromise is possible.
• Reverse shell → potential privilege escalation → server takeover.
• Attack is trivial to automate with curl, Python scripts, or Nuclei.

8. Conclusion

This project demonstrates the full exploitation chain for CVE-2024-7954, from reconnaissance to obtaining an interactive shell.

Exploitation Path

1. Recon (FOFA)
2. Automated Scanning (Nuclei)
3. Manual Payload Injection
4. Verified Code Execution
5. Reverse Shell Access

Security Lessons

• Strict input validation is mandatory for all user-controlled data.
• Plugins must follow secure coding practices.
• Organizations must apply security patches promptly.
• Regular vulnerability assessments are essential to prevent RCE attacks.

This vulnerability highlights how a seemingly harmless text formatting plugin can create a complete system compromise when improperly secured.