spid3hex/cve-2024-1071-poc-scriptwp/ultimate-member - SQL Injection Vulnerability Exploit Script.
This Proof of Concept (POC) is made for educational and ethical testing purposes only.
Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
The WordPress Ultimate Member plugin (versions 2.1.3 to 2.8.2) has a SQL Injection vulnerability through the sorting parameter. This occurs due to insufficient input validation and unprepared SQL queries, allowing unauthenticated users to manipulate queries and extract sensitive data from affected databases.
Affected Plugin Versions: 2.1.3 to 2.8.2
Severity: High
CVE ID: CVE-2024-1071
PoC is now published. It was created for educational/research purposes only! Use it at your own risk!
Identify potential targets with tools like FOFA or Shodan.io using the following dorks:
body="/wp-content/plugins/ultimate-member"body="/wp-content/plugins/ultimate-member"To get started, clone the repository using the following commands:
git clone https://github.com/Spid3heX/CVE-2024-1071-PoC-Script.git
cd CVE-2024-1071-PoC-Script
The script can scan either a single target URL or multiple URLs listed in a file. It will evaluate each target for vulnerability and provide feedback.
Command Line Arguments -f, --file: Specify a text file containing a list of target URLs to scan.
To scan a single target URL:
python cve-2024-1071.py https://example.com
To scan multiple targets from a file:
python cve-2024-1071.py -f targets.txt