CVE-2024-2961 PoC — GNU C Library 安全漏洞

Source

https://github.com/suce0155/CVE-2024-2961_buddyforms_2.7.7

Associated Vulnerability

Title:GNU C Library 安全漏洞 (CVE-2024-2961)
Description:The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Description

CVE-2024-2961 Cnext RCE Exploit with Buddyforms 2.7.7

Readme

# Buddyforms 2.7.7 CNEXT RCE 
Abusing CVE-2024-2961 and CVE-2023–26326 to RCE 
# Usage
```code
git-clone https://github.com/suce0155/CVE-2024-2961_buddyforms_2.7.7
pip install -r requirements.txt
python3 buddyforms_2.7.7_cnext_exploit.py http://site/wp-admin/admin-ajax.php {ip} {port}
```
# Analysis and Technical Details

Check out my [**blog post**](https://medium.com/@suce0155/cve-2024-2961-buddyforms-2-7-7-iconv-lfi-to-rce-ee6409ccf9f9)

# POC

![Alt Text](https://github.com/suce0155/CVE-2024-2961_buddyforms_2.7.7/blob/main/poc.gif)

File Snapshot


 [4.0K]  /data/pocs/e06fc2a9be68c178e813f2bf3486cf560d13a761
├── [ 23K]  buddyforms_2.7.7_cnext_exploit.py
├── [6.1M]  poc.gif
├── [ 544]  README.md
└── [  13]  requirements.txt

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!