CVE-2024-50498 PoC — WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

Source

https://github.com/p0et08/CVE-2024-50498

Associated Vulnerability

Title: WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability (CVE-2024-50498)
Description:Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.

Description

This is a exploit for CVE-2024-50498

Readme

# CVE-2024-50498
# Affected Version
  `WP Query Console <=1.0`
# Credit
  `https://github.com/RandomRobbieBF/CVE-2024-50498`
# Premise
## Query Type is WP_Query and WP Query Console executes some php functions 
![Vulnerabilities](./pictures/1.png)
# Usage
`python .\CVE-2024-50498.py 192.168.41.163 --query "id"`
![result](./pictures/2.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →