CVE-2024-0844 PoC — WordPress plugin Popup More Popups, Lightboxes, and more popup modules 安全漏洞

Source

https://github.com/0x9567b/CVE-2024-0844

Associated Vulnerability

Title:WordPress plugin Popup More Popups, Lightboxes, and more popup modules 安全漏洞 (CVE-2024-0844)
Description:The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData() function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files ending with "Form.php" on the server , allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Description

Path traversal in the popup-more WordPress plugin

Readme

# Popup-more  < 2.2.0 CVE-2024-0844
Path traversal in the popup-more WordPress plugin.

### Description
Vulnerable file location : /popup-more/classes/Ajax.php <br>
Link : https://wordpress.org/plugins/popup-more/#description <br>
Version : - < **2.2.0** <br>
Parameter: formKey <br>
Status: patched <br>

https://github.com/advisories/GHSA-wxfh-8hrr-vfjw

### Code snippet: 

```php
require_once YPM_POPUP_CLASSES.'form/'.esc_attr($key).'Form.php';
```

### Proof of concept:
![lfi_poc (1)](https://github.com/0x9567b/popup-more/assets/72038577/eddd0850-0fb8-4672-893f-5fed5f540193)

File Snapshot


 [4.0K]  /data/pocs/bb4ac0f60dbc99d52caac0c0fe1e9fff40f8f727
└── [ 584]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!