CVE-2023-6634 PoC — LearnPress <= 4.2.5.7 - Command Injection

Source

https://github.com/krn966/CVE-2023-6634

Associated Vulnerability

Title:LearnPress <= 4.2.5.7 - Command Injection (CVE-2023-6634)
Description:The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.

Description

CVE-2023-6634

Readme

# CVE-2023-6634 Exploit Script

## Description

This repository contains a Python script designed to exploit the CVE-2023-6634 vulnerability found in the LearnPress plugin for WordPress, versions up to and including 4.2.5.7. The vulnerability allows for remote code execution (RCE) due to improper input validation in the `load_content_via_ajax` function.

## Disclaimer

This tool is provided for educational purposes and authorized penetration testing only. Use of this tool against systems without explicit permission is illegal and unethical. By downloading or using this tool, you agree to use it in a responsible and ethical manner.

## Installation

No installation is necessary beyond having Python 3 and the `requests` library installed on your system. You can install the required Python library using the following command:

```
pip install requests
```

## Usage

The script can be run from the command line by providing the target URL and the command you wish to execute on the vulnerable WordPress site. For example:

```
python CVE-2023-6634.py http://example.com "whoami"
```

Replace `http://example.com` with the URL of the target WordPress site and `"whoami"` with the command you wish to execute.

## Features

- Dynamic payload construction for exploiting CVE-2023-6634.
- Command-line arguments for easy use and integration into automated workflows.
- Detailed response output for assessing exploit success.

## Contributing

Contributions to improve the script or extend its functionality are welcome. Please ensure that any pull requests or issues adhere to ethical guidelines and do not promote unauthorized use.

## License

[MIT License](LICENSE)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/learnpress/learnpress-4257-command-injection
- https://wpscan.com/vulnerability/909580f4-1306-4e61-ac7d-e7a2eb0961f8/
- https://nvd.nist.gov/vuln/detail/CVE-2023-6634

## Acknowledgments

- Authors of the exploit: iamnoooob, rootxharsh, pdresearch
- Vulnerability researchers and the cybersecurity community for providing the insights necessary to develop this script.

File Snapshot


 [4.0K]  /data/pocs/2dbb5d4a0621c5a60f6b2d67a87cdcee33b6a07c
├── [1.9K]  CVE-2023-6634.py
└── [2.1K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!