一、 漏洞 CVE-2024-25600 基础信息
漏洞信息
                                        # WordPress Bricks Theme <= 1.9.6 - 未经认证的远程代码执行（RCE）漏洞

## 概述
Codeer Limited的Bricks Builder中存在的漏洞允许代码注入（Code Injection）。该漏洞归类为不恰当的代码生成控制（"Code Injection"）。

## 影响版本
从未指定版本到1.9.6版本的Bricks Builder都受到影响。

## 细节
由于不恰当的代码生成控制，攻击者能够在Bricks Builder中注入恶意代码。此漏洞可能导致系统执行任意代码。

## 影响
如果该漏洞被利用，攻击者可以注入并执行恶意代码，导致未授权的操作或系统损坏。
提示
尽管我们采用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。
神龙会尽力确保数据准确，但也请结合实际情况进行甄别与判断。
神龙祝您一切顺利！
漏洞标题
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
来源：美国国家漏洞数据库 NVD
漏洞描述信息
Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.
来源：美国国家漏洞数据库 NVD
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
来源：美国国家漏洞数据库 NVD
漏洞类别
对生成代码的控制不恰当(代码注入)
来源：美国国家漏洞数据库 NVD
漏洞标题
WordPress Plugin Bricks Builder Theme 安全漏洞
来源：中国国家信息安全漏洞库 CNNVD
漏洞描述信息
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin Bricks Builder Theme 1.9.6版本存在安全漏洞，该漏洞源于允许攻击者通过利用随机数泄漏来绕过身份验证来执行任意 PHP 代码。
来源：中国国家信息安全漏洞库 CNNVD
CVSS信息
N/A
来源：中国国家信息安全漏洞库 CNNVD
漏洞类别
其他
来源：中国国家信息安全漏洞库 CNNVD
二、漏洞 CVE-2024-25600 的公开POC
# POC 描述 源链接 神龙链接
1 Unauthenticated Remote Code Execution – Bricks <= 1.9.6 https://github.com/Chocapikk/CVE-2024-25600 POC详情
2 Nuclei template and information about the POC for CVE-2024-25600 https://github.com/Christbowel/CVE-2024-25600_Nuclei-Template POC详情
3 This tool is designed to exploit the CVE-2024-25600 vulnerability found in the Bricks Builder plugin for WordPress. The vulnerability allows for unauthenticated remote code execution on affected websites. The tool automates the exploitation process by retrieving nonces and sending specially crafted requests to execute arbitrary commands. https://github.com/Tornad0007/CVE-2024-25600-Bricks-Builder-plugin-for-WordPress POC详情
4 (Mirorring) https://github.com/hy011121/CVE-2024-25600-wordpress-Exploit-RCE POC详情
5 A PoC exploit for CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution (RCE) https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT POC详情
6 This tool is designed to exploit the CVE-2024-25600 vulnerability found in the Bricks Builder plugin for WordPress. The vulnerability allows for unauthenticated remote code execution on affected websites. The tool automates the exploitation process by retrieving nonces and sending specially crafted requests to execute arbitrary commands. https://github.com/0bl1v10nf0rg0773n/0BL1V10N-CVE-2024-25600-Bricks-Builder-plugin-for-WordPress POC详情
7 WORDPRESS-CVE-2024-25600-EXPLOIT-RCE - WordPress Bricks Builder Remote Code Execution (RCE) https://github.com/X-Projetion/WORDPRESS-CVE-2024-25600-EXPLOIT-RCE POC详情
8 None https://github.com/RHYru9/CVE-2024-25600-mass POC详情
9 None https://github.com/k3lpi3b4nsh33/CVE-2024-25600 POC详情
10 None https://github.com/WanLiChangChengWanLiChang/CVE-2024-25600 POC详情
11 0BL1V10N's CVE-2024-25600 for Bricks Builder (TryHackMe) plugin for WordPress exploit https://github.com/ivanbg2004/0BL1V10N-CVE-2024-25600-Bricks-Builder-plugin-for-WordPress POC详情
12 None https://github.com/KaSooMi0228/CVE-2024-25600-Bricks-Builder-WordPress POC详情
13 None https://github.com/svchostmm/CVE-2024-25600-mass POC详情
14 Unauthenticated Remote Code Execution – Bricks https://github.com/wh6amiGit/CVE-2024-25600 POC详情
15 Repository for internship test task. https://github.com/Sibul-Dan-Glokta/test-task-CVE-2024-25600 POC详情
16 Unauthenticated RCE exploit for CVE-2024-25600 in WordPress Bricks Builder <= 1.9.6. Executes arbitrary code remotely. https://github.com/so1icitx/CVE-2024-25600 POC详情
17 Unauthenticated RCE exploit for CVE-2024-25600 in WordPress Bricks Builder <= 1.9.6. Executes arbitrary code remotely. https://github.com/cboss43/CVE-2024-25600 POC详情
18 PoC for CVE-2024-25600 https://github.com/meli0dasH4ck3r/cve-2024-25600 POC详情
19 OD&H's scanner for CVE-2024-25600 vulnerability in the Bricks Builder WordPress plugin. For use in Try Hack Me (THM) environments. https://github.com/ivanbg2004/ODH-BricksBuilder-CVE-2024-25600-THM POC详情
20 Bricks Builder is a popular WordPress development theme with approximately 25,000 active installations. It provides an intuitive drag-and-drop interface for designing and building WordPress websites. Bricks <= 1.9.6 is vulnerable to unauthenticated remote code execution (RCE) which means that anybody can run arbitrary commands and take over the site/server. This can lead to various malicious activities https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-25600.yaml POC详情
21 None https://github.com/NanoWraith/CVE-2024-25600 POC详情
22 Tools for scan CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution (RCE) https://github.com/DedsecTeam-BlackHat/Poleposph POC详情
23 None https://github.com/r0otk3r/CVE-2024-25600 POC详情
24 cve-2024-25600-report https://github.com/frankfm-labs/bricks-rce-writeup POC详情
三、漏洞 CVE-2024-25600 的情报信息
四、漏洞 CVE-2024-25600 的评论

暂无评论

发表评论