CVE-2023-4636 PoC — WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Source

https://github.com/ThatNotEasy/CVE-2023-4636

Associated Vulnerability

Title: WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVE-2023-4636)
Description:The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Description

Unauthenticated Remote Code Execution with default Imagick

Readme

## CVE-2023-4636
- The vulnerability in the limelight is an unauthenticated remote code execution (RCE) issue stemming from insufficient controls on file paths occurring during image processing via Imagick. It enables adversaries to supply files via FTP, leading to local file inclusion and remote code execution. Under these conditions, an attacker could potentially take over any unpatched WordPress site. 
## Screenshot
![Screenshot_1](https://github.com/ThatNotEasy/CVE-2023-4636/assets/25004320/6e3b9fbc-a512-4791-a1ec-729e9c504451)
## Requirements
- Python3.7+
## Supported Os
- Linuxer
- Wingays
## Get start with
```
$ git clone https://github.com/ThatNotEasy/CVE-2023-4636
$ cd CVE-2023-4636
$ pip/pip3 install -r requirements.txt
$ python/python3 CVE-2023-4636.py
```
## Footprints Notes
- By using this tool, you agree that you are using it for educational purposes only and that you will not use it for any illegal activity. You also agree to bear all risks associated with the use of this tool. I will not be responsible for direct or indirect damage caused by the use of this tool. Don't suyyyyyyyyyyyyyyyyyyyy me!
## Author
- Pari Malam
## Contacts
[![Telegram](https://img.shields.io/badge/-Telegram-blue)](https://telegram.me/SurpriseMTFK)
[![Discord](https://img.shields.io/badge/-Discord-purple)](https://discordapp.com/users/829404192585678858)

## Credits:
- PatrickOwl

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →