CVE-2024-28890 PoC — WordPress plugin Forminator 安全漏洞

Source

https://github.com/RHYru9/CVE-2024-28890-checker

Associated Vulnerability

Title:WordPress plugin Forminator 安全漏洞 (CVE-2024-28890)
Description:Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.

Readme

# Exploit Script

This repository contains a Python script (`exp.py`) designed to check for vulnerabilities FORMINATOR RCE and execute a reverse shell on a given URL.

## Usage

## checker
```sh
python check.py
```
To use the script, run the following command:
```sh
python3 exp.py -u http://127.0.0.1:8000/?p=7
```
## check vuln or not
```sh
python3 exp.py -u http://127.0.0.1:8000/?p=7 -v
```

## reverse shell
```sh
python3 exp.py -u http://127.0.0.1:8000/?p=7 -r
```

File Snapshot


 [4.0K]  /data/pocs/9c9eb02ef92502d3877f342873327787193a59f9
├── [2.2K]  check.py
├── [ 11K]  exp.py
├── [2.8K]  fr.txt
├── [ 471]  README.md
└── [ 752]  vuln.txt

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!