Alpastx

GitHub · Repository owner · Source ID 93777011
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

Alpastx/CVE-2023-3452---WordPress-Canto-Plugin-RCE

Repository PoC0Created 2026-03-03ExploitCVE-2023-34524 files

14.1 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2023-3452, an unauthenticated Remote File Inclusion (RFI) vulnerability in the WordPress Canto plugin (≤ 3.0.4), to achieve Remote Code Execution (RCE). It serves a malicious PHP file via a local HTTP server and triggers the inclusion via the 'wp_abspath' parameter.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2023-3452. It creates a temporary PHP file containing a user-supplied command, serves it via a local HTTP server, and triggers the target's RFI vulnerability to execute it. All behavior is consistent with the stated purpose of demonstrating the CVE. No concealed, deceptive, or unrelated harmful actions were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonPHP
Target softwareWordPress Canto Plugin
Attack typesRemote File InclusionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (canto_exploit.py) that actively exploits a vulnerability to execute arbitrary commands on a remote target. It includes a full exploitation chain: vulnerability check, payload generation, HTTP server setup, and RFI trigger. The README explicitly describes it as an 'Exploit' and provides usage examples for achieving RCE.

README.md:3canto_exploit.py:1-3canto_exploit.py:127-168

Requirements

  • Target must be running a vulnerable version of the WordPress Canto plugin (≤ 3.0.4).canto_exploit.py:110-111
  • The attacker's machine must be reachable from the target server on the specified payload port.README.md:99-100
  • The target server must have 'allow_url_include' enabled for remote file inclusion to work.README.md:17

Observed behavior

  • Checks if the target is vulnerable by fetching the plugin's readme.txt and parsing the version number.canto_exploit.py:94-125
  • Creates a malicious PHP file (wp-admin/admin.php) containing a system() call with the attacker-supplied command.canto_exploit.py:62-73
  • Starts a local HTTP server to host the malicious PHP file.canto_exploit.py:75-86
  • Sends a request to the vulnerable download.php endpoint with the 'wp_abspath' parameter pointing to the attacker's server, causing the target to include and execute the remote PHP file.canto_exploit.py:139-144
  • Displays the output of the executed command returned in the HTTP response.canto_exploit.py:146-158
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldThis is the core exploit logic, consistent with the documented CVE-2023-3452 vulnerability.canto_exploit.py:62-70canto_exploit.py:75-86canto_exploit.py:127-170
Network Behavior
Payload withheldThis is explicitly documented in the README as a feature to support HTTPS targets, and is a common practice in exploit scripts.canto_exploit.py:29canto_exploit.py:101canto_exploit.py:144
Payload Generation
Payload withheldThe command is directly taken from user input or a default sanity check ('id; whoami; hostname'). No hidden or additional commands are injected.canto_exploit.py:67canto_exploit.py:266
Review boundaries

What the analysis did not establish

  • One file (metadata only) was omitted from the evidence packet, but all readable text files are included and complete.
  • The evidence does not include the target's server configuration, so the prerequisite 'allow_url_include' cannot be verified from the artifact alone.
  • One file (metadata only) was omitted from the text evidence; its content was not reviewed.
  • The review is based solely on the supplied text; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.