CVE-2024-27971 PoC — WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability

Source

https://github.com/truonghuuphuc/CVE-2024-27971-Note

Associated Vulnerability

Title: WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability (CVE-2024-27971)
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Permalink Manager for WooCommerce woo-permalink-manager.This issue affects Premmerce Permalink Manager for WooCommerce: from n/a through <= 2.3.10.

Readme

# CVE-2024-27971-Note
WordPress Premmerce Permalink Manager for WooCommerce Plugin <= 2.3.10 is vulnerable to Local File Inclusion
https://patchstack.com/database/vulnerability/woo-permalink-manager/wordpress-premmerce-permalink-manager-for-woocommerce-plugin-2-3-10-local-file-inclusion-vulnerability

1. I diff woo-permalink-manager.2.3.10 and woo-permalink-manager.2.3.11
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/af9616e9-b731-4f48-b287-36693662cfc7)



3. File: src\Admin\Admin.php => function options() call function includeTemplate(vendor\premmerce\wordpress-sdk\src\V2\FileManager\FileManager.php)
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/a082d1aa-4bfe-42fd-87e4-eac3cc80d363)

4. File: vendor\premmerce\wordpress-sdk\src\V2\FileManager\FileManager.php => function includeTemplate call function locateTemplate

![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/30ef699a-8d46-480a-84bd-a46bde74d006)
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/642bd242-38ad-4928-8fa9-d9e6508a083d)

4. File: views\admin\main.php
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/6b385e8b-74c5-45c3-83de-6189087136a4)

Build wordpress: docker-compose -f stack.yml up

Note: wordpress install plugin Premmerce Permalink Manager for WooCommerce and WooCommerce
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/dfd652d6-d28b-4fdc-a24e-df6ca4ea72f7)


5. I use pearcmd.php write pwn.php
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/12dfc88e-86a0-4c3b-84a2-cb887097e0bf)

6. Requests pwn.php
![image](https://github.com/truonghuuphuc/CVE-2024-27971-Note/assets/20487674/6ab06f37-d31f-43f4-a718-39e89695e5b4)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →