Proof-Of-Concept Code for CVE-2024-8353

This repository contains a script for exploiting the CVE-2024-8353 vulnerability in the GiveWP plugin for WordPress. This vulnerability allows unauthenticated PHP Object Injection, potentially leading to remote code execution.

Overview

The provided scripts demonstrate the exploit:

• Python Script: Automates the process of identifying vulnerable forms, retrieving nonces, and delivering payloads to trigger the vulnerability.
• PHP Script: Serves as a crafted payload to showcase the deserialization attack mechanics.

Vulnerability Description

CVE-2024-8353 affects versions of the GiveWP plugin up to and including 3.16.1. The vulnerability arises due to improper handling of serialized input through parameters like give_title and card_address. Attackers can exploit this to inject and execute arbitrary PHP code.

Prerequisites

• Python 3.x
• PHP 7.x or later
• Required Python packages listed in requirements.txt

Usage

Python Script

1. Install dependencies:

   pip install -r requirements.txt

2. Example command:

   python3 exploit.py --url https://target-wordpress-site.com --cmd "cat /etc/passwd"

3. Run the script:

   pip install -r requirements.txt

4. Run the script:

   python3 exploit.py --url <TARGET_URL> --cmd <COMMAND>

Disclaimer

This repository is intended for educational purposes only. Use responsibly and only on systems you own or have explicit permission to test. The author is not responsible for any damage caused by the use of this exploit.

Contributions

Contributions to improve the scripts or enhance their functionality are welcome. Please submit a pull request or create an issue for discussion.

License

This project is licensed under the MIT License. See the LICENSE file for details.