MobetaSec

GitHub · Repository owner · Source ID 141402996
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

MobetaSec/CVE-2024-1813-POC

Repository PoC0Created 2026-06-18ExploitCVE-2024-18138 files

1.3 MiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is an end-to-end exploit for CVE-2024-1813. It includes a Python script (sjb_cve_2024_1813.py) that builds a serialized PHP object payload using a Monolog/RCE1 gadget chain, encodes it to bypass sanitization, and submits it via an unauthenticated HTTP POST to a vulnerable WordPress plugin. The README provides instructions to run the script and trigger the deserialization, resulting in remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python PoC script for CVE-2024-1813. The script builds and sends a serialized PHP object to exploit a known vulnerability in the Simple Job Board WordPress plugin. All behavior is consistent with the stated exploit: it constructs a Monolog/RCE1 gadget chain, encodes it for transport, and submits it via a public application form. No concealed backdoor, unrelated payload, or operator-directed harm beyond the declared exploit is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespythonmarkdown
Target softwarewordpresssimple_job_board
Attack typesphp_object_injectionremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively builds and delivers a malicious serialized PHP object to a vulnerable endpoint, with the stated purpose of achieving remote code execution. The README explicitly describes it as an 'exploit' and provides end-to-end instructions for running it against a target. This constitutes exploit code, not merely a scanner or writeup.

README.md:1README.md:5-7README.md:64-75sjb_cve_2024_1813.py:1-18

Requirements

  • Target must run Simple Job Board plugin version <= 2.11.0 and have a third-party plugin (e.g., All In One SEO) providing a POP gadget chain.README.md:10-14README.md:52-54
  • Attacker needs a valid job_id from the target WordPress site.sjb_cve_2024_1813.py:11sjb_cve_2024_1813.py:196

Observed behavior

  • The Python script builds a serialized PHP object payload containing a Monolog/RCE1 gadget chain that executes an arbitrary system command.sjb_cve_2024_1813.py:42-75
  • The script encodes the payload to bypass WordPress sanitization (e.g., using PHP's S: format for strings with null bytes, and double backslashes).sjb_cve_2024_1813.py:78-114
  • The script fetches a wp_nonce from the target job page and submits the malicious payload via an unauthenticated POST request to /wp-admin/admin-ajax.php.sjb_cve_2024_1813.py:117-133sjb_cve_2024_1813.py:165-189
  • The README instructs the user to run the script to store the payload and then trigger the deserialization by simulating an admin viewing the applicants list, resulting in command execution.README.md:66-75
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the normal behavior of the described CVE-2024-1813 exploit. The command is provided by the operator as a CLI argument and is not hardcoded.sjb_cve_2024_1813.py:42-75sjb_cve_2024_1813.py:197
Network Activity
Payload withheldThis is the expected delivery mechanism for the exploit against the vulnerable plugin.sjb_cve_2024_1813.py:165-189
Payload Encoding
Payload withheldThese encoding steps are necessary for the exploit to work and are not indicative of hidden behavior.sjb_cve_2024_1813.py:78-114
Review boundaries

What the analysis did not establish

  • The evidence includes only two text files (README.md and sjb_cve_2024_1813.py) out of eight total files. The remaining files, including lab setup scripts and a GIF demo, are not provided as text, limiting full verification of the lab environment.
  • The analysis is based solely on static code review; the exploit code was not executed, and its effectiveness is not verified.
  • Six files in the repository were not included in the text evidence (metadata only). Their content is unknown.
  • One non-text media file (poc.gif) was not analyzed.
  • The review is limited to the supplied text; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.