CVE-2024-12877-Exploit

Educational CVE-2024-12877 exploit demo for PHP Object Injection in GiveWP WordPress plugin. Includes root cause analysis, regex bypass techniques, and safe exploitation practices.

GiveWP powers thousands of charity websites, NGOs, and fundraising platforms. Because it handles sensitive financial and donor data, a vulnerability here is highly impactful. An attacker exploiting object injection can escalate from a single plugin to compromising the entire WordPress installation and the underlying server.

⚙️ Vulnerability Details

• Root Cause: unserialize() on untrusted input.

• PHP Magic Methods: PHP automatically invokes these during object lifecycle:

• The vulnerability stems from unsafe use of the PHP function unserialize() on user-controlled input. While unserialize() is designed to rebuild PHP data structures, it comes with a dangerous side effect: when objects are reconstructed, PHP automatically invokes magic methods.

Magic Methods in PHP

• __wakeup() – triggered when an object is unserialized

• __destruct(), __toString(), __get/__set(), __call/__callStatic() – can be leveraged for malicious execution

• Regex Validation: GiveWP implemented regex checks to detect serialized input. While the new regex catches more data types, regex cannot reliably prevent object injection.

Key insight:

With a crafted serialized object, the attacker sets object properties, and PHP itself executes the attacker’s logic by invoking the magic methods

Regex Validation

GiveWP implemented regex-based validation to check if input was serialized. Old Regex (incomplete)

• Only recognized arrays and objects.

• Other serialized types (string, int, bool, float, null) bypassed detection.

New Regex (improved, but flawed)

• Recognizes all PHP serialized types.

• Blocks some trivial payloads.

• But the core problem remains: if unserialize() is used on user input, regex can’t save you.

This snippet was written to compare two different regex implementations:

• is_serialized_old() → the old version, which only detects arrays and objects.

• is_serialized_new() → the improved version, which recognizes all PHP serialized data types (arrays, objects, strings, integers, booleans, floats, and null). We create a set of test values (array, object, string, integer, boolean, float, null), serialize them, and then check each one against both regex functions. In simple terms:

And after running this code on your dokcer see on browser this resulte

💥 Exploit Demo

Step 1

Step 2: Create a vulnerable class

This class has a __wakeup() method that will execute automatically when unserialized.

Step 3: Craft payload

Step 4: Output After the saveing file at this file you can see this exlpit

Exploit :

• Old Regex: FALSE → failed to detect the payload.

• New Regex: TRUE → detected it as serialized input.

• Executing: Hello RCE! → The payload was unserialized, and the magic method __wakeup() executed attacker-controlled code.

Prevention • Do not use unserialize() on untrusted input. Replace it with json_decode() or other safer alternatives.

• Keep GiveWP and all WordPress plugins updated.

• Deploy a Web Application Firewall (WAF) to block malicious serialized payloads.

• Follow the Principle of Least Privilege: run PHP and database accounts with minimum required permissions.

Results:

• Old Regex: ❌ fails to detect payload
• New Regex: ✅ detects serialized input but cannot prevent RCE

Key insight: Never rely on regex to secure unserialize(). The safest approach is to avoid unserializing untrusted input altogether.

🛡 Prevention

• Do not use unserialize() on untrusted input; prefer json_decode() or other safe alternatives.
• Keep GiveWP and all WordPress plugins updated.
• Deploy a Web Application Firewall (WAF) to block malicious payloads.
• Apply the Principle of Least Privilege for PHP and database accounts.

📱 Follow Our Weekly CVE Analysis

I run two Telegram channels dedicated to vulnerability research and exploitation:

1. GO-TO CVE Weekly Episodes: Every week, we dive deep into a new CVE and share detailed analysis, demos, and insights. 🔗 Join us here

2. CVEdb – Exploit Archive: This channel archives 1-day exploits and custom PoCs for CVEs. A great resource for researchers who want to see active exploitation techniques. 🔗 Join CVEdb

Follow the channels to stay up-to-date with the latest CVEs, exploitation techniques, and security research insights.

📚 References

• NVD CVE-2024-12877
• Wordfence Analysis
• GiveWP Source

⚖️ Legal Disclaimer

This repository is strictly for educational and research purposes. Exploiting vulnerabilities without permission is illegal and unethical. The author is not responsible for misuse.