CVE-2024-27971 PoC — WordPress plugin Premmerce Permalink Manager for WooCommerce 安全漏洞

介绍

# CVE-2024-27971-Note
WordPress Premmerce Permalink Manager for WooCommerce Plugin <= 2.3.10 is vulnerable to Local File Inclusion
https://patchstack.com/database/vulnerability/woo-permalink-manager/wordpress-premmerce-permalink-manager-for-woocommerce-plugin-2-3-10-local-file-inclusion-vulnerability

1. I diff woo-permalink-manager.2.3.10 and woo-permalink-manager.2.3.11
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/af9616e9-b731-4f48-b287-36693662cfc7)



3. File: src\Admin\Admin.php => function options() call function includeTemplate(vendor\premmerce\wordpress-sdk\src\V2\FileManager\FileManager.php)
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/a082d1aa-4bfe-42fd-87e4-eac3cc80d363)

4. File: vendor\premmerce\wordpress-sdk\src\V2\FileManager\FileManager.php => function includeTemplate call function locateTemplate

![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/30ef699a-8d46-480a-84bd-a46bde74d006)
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/642bd242-38ad-4928-8fa9-d9e6508a083d)

4. File: views\admin\main.php
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/6b385e8b-74c5-45c3-83de-6189087136a4)

Build wordpress: docker-compose -f stack.yml up

Note: wordpress install plugin Premmerce Permalink Manager for WooCommerce and WooCommerce
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/dfd652d6-d28b-4fdc-a24e-df6ca4ea72f7)


5. I use pearcmd.php write pwn.php
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/12dfc88e-86a0-4c3b-84a2-cb887097e0bf)

6. Requests pwn.php
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/6ab06f37-d31f-43f4-a718-39e89695e5b4)

文件快照

备注