POC详情： b016134f1246a8ef5e8f239ae59daf416f91c434

来源
https://github.com/KTN1990/CVE-2024-43160
关联漏洞
标题： WordPress plugin BerqWP 代码问题漏洞 (CVE-2024-43160)
描述：WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin BerqWP 1.7.6 版本及之前版本存在代码问题漏洞，该漏洞源于包含一个不受限制文件上传漏洞。
描述
The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads
介绍
# Wordpress BerqWP <= 1.7.6 - Unauthenticated Arbitrary File Uplaod

[CVE-2024-43160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43160) The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

For more wordpress exploits and exclusive ones contact me on telegram [@KtN1990](https://t.me/KtN1990).

## Usage

To run this exploit you need to have python 3 and websites list then execute

```bash
  python3 exploit.py -l list.txt -t 100
```

## Contact

- [@KtN1990](https://t.me/KtN1990)
  
## More Exploits, Check Megatron!

![Logo](https://raw.githubusercontent.com/KTN1990/CVE-2022-0316_wordpress_multiple_themes_exploit/main/files/megatron.jpg)


- Provides an easy and efficient way to assess and exploit Wordpress security holes for mass purposes.
- 150+ Exploits, all types (RCE, LOOTS, AUTHBYPASS...).
- Customizable config.
- Monthly Free updates including more code opitmization, fixing bugs, adding more exploits plus 0days.
- Strong code base and custom threading and process model using a tasks management feature, getting reliable results is assured; no need to talk about speed since at KTN we use unconventional methods for concurrency.
- [Telegram Channel](https://t.me/megatron_ktn)



## Demo

[![IMAGE ALT TEXT HERE](https://i.ytimg.com/vi_webp/irrh91Iaz7c/mqdefault.webp)](https://www.youtube.com/watch?v=irrh91Iaz7c)

## License

[MIT](https://choosealicense.com/licenses/mit/)
文件快照

 [4.0K]  /data/pocs/b016134f1246a8ef5e8f239ae59daf416f91c434
├── [3.5K]  BerqWP.py
└── [1.8K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。