CVE-2024-8353 PoC — WordPress plugin GiveWP 代码问题漏洞

Description

Proof-of-Concept for CVE-2024-5932  GiveWP PHP Object Injection 

介绍

# Proof-Of-Concept Code for CVE-2024-8353

This repository contains a script for exploiting the CVE-2024-8353 vulnerability in the GiveWP plugin for WordPress. This vulnerability allows unauthenticated PHP Object Injection, potentially leading to remote code execution.

## Overview

The provided scripts demonstrate the exploit:

- **Python Script**: Automates the process of identifying vulnerable forms, retrieving nonces, and delivering payloads to trigger the vulnerability.
- **PHP Script**: Serves as a crafted payload to showcase the deserialization attack mechanics.

### Vulnerability Description

CVE-2024-8353 affects versions of the GiveWP plugin up to and including 3.16.1. The vulnerability arises due to improper handling of serialized input through parameters like `give_title` and `card_address`. Attackers can exploit this to inject and execute arbitrary PHP code.


## Prerequisites

- Python 3.x
- PHP 7.x or later
- Required Python packages listed in `requirements.txt`

## Usage

### Python Script

1. Install dependencies:
   ```bash
   pip install -r requirements.txt
   ```

2. Example command:
   ```bash
   python3 exploit.py --url https://target-wordpress-site.com --cmd "cat /etc/passwd"
   ```

3. Run the script:
   ```bash
   pip install -r requirements.txt
   ```

2. Run the script:
   ```bash
   python3 exploit.py --url <TARGET_URL> --cmd <COMMAND>
   ```

## Disclaimer

This repository is intended for educational purposes only. Use responsibly and only on systems you own or have explicit permission to test. The author is not responsible for any damage caused by the use of this exploit.

## Contributions

Contributions to improve the scripts or enhance their functionality are welcome. Please submit a pull request or create an issue for discussion.

## License

This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.

文件快照

备注