CVE-2022-4047 PoC — Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload

Source

https://github.com/entroychang/CVE-2022-4047

Associated Vulnerability

Title:Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload (CVE-2022-4047)
Description:The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE

Description

CVE-2022-4047 poc

Readme

# CVE-2022-4047

> Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload

## Usage

```
 @@@@@@@  @@@  @@@  @@@@@@@@              @@@@@@    @@@@@@@@    @@@@@@    @@@@@@                   @@@    @@@@@@@@        @@@   @@@@@@@@  
@@@@@@@@  @@@  @@@  @@@@@@@@             @@@@@@@@  @@@@@@@@@@  @@@@@@@@  @@@@@@@@                 @@@@   @@@@@@@@@@      @@@@   @@@@@@@@  
!@@       @@!  @@@  @@!                       @@@  @@!   @@@@       @@@       @@@                @@!@!   @@!   @@@@     @@!@!        @@!  
!@!       !@!  @!@  !@!                      @!@   !@!  @!@!@      @!@       @!@                !@!!@!   !@!  @!@!@    !@!!@!       !@!   
!@!       @!@  !@!  @!!!:!    @!@!@!@!@     !!@    @!@ @! !@!     !!@       !!@    @!@!@!@!@   @!! @!!   @!@ @! !@!   @!! @!!      @!!    
!!!       !@!  !!!  !!!!!:    !!!@!@!!!    !!:     !@!!!  !!!    !!:       !!:     !!!@!@!!!  !!!  !@!   !@!!!  !!!  !!!  !@!     !!!     
:!!       :!:  !!:  !!:                   !:!      !!:!   !!!   !:!       !:!                 :!!:!:!!:  !!:!   !!!  :!!:!:!!:   !!:      
:!:        ::!!:!   :!:                  :!:       :!:    !:!  :!:       :!:                  !:::!!:::  :!:    !:!  !:::!!:::  :!:       
 ::: :::    ::::     :: ::::             :: :::::  ::::::: ::  :: :::::  :: :::::                  :::   ::::::: ::       :::    ::       
 :: :: :     :      : :: ::              :: : :::   : : :  :   :: : :::  :: : :::                  :::    : : :  :        :::   : :       
                                                                                                                                          

usage: exploit.py [-h] [-u URL] [-f FILE]

CVE-2022-4047 - Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload (Mass PHP File Upload)

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     url
  -f FILE, --file FILE  url list
```

* Remeber to install `requests`
    * `pip3 install requests`
* `python3 exploit.py -u url`
* `python3 exploit.py -f file_path`
* Results for both types mentioned above will be saved in either vuln.txt or novuln.txt. If the target is found to be vulnerable, the path to the webshell will be recorded in uploaded.txt.
* Just a note: I have set up a proxy on port 8080 for easier monitoring of the situation, so remember to turn on your burp suite XD.

File Snapshot


 [4.0K]  /data/pocs/5c41adb529c5d09cd7cede492053330896afe83c
├── [5.9K]  exploit.py
├── [2.4K]  README.md
└── [  38]  testing.php

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!