jesicatjan/WordPress-NotificationX-CVE-2024-1698

GitHubRepository PoC

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2024-1698Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with a MySQL 5.7 database and a WordPress instance built from a custom Dockerfile that installs the NotificationX 2.8.2 plugin. The README and exploit.py demonstrate a SQL injection attack against the plugin's analytics endpoint.

docker-compose.yml:1-40Dockerfile:1-10README.md:1-20exploit.py:1-33

Lab assessment

Vulnerability lab

The environment includes a vulnerable WordPress plugin (NotificationX 2.8.2) and provides a README with a curl command and an exploit.py script that perform a time-based blind SQL injection to extract the admin password hash. This is a deliberate setup for demonstrating CVE-2024-1698.

Dockerfile:6-9README.md:11-17exploit.py:1-33
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MySQL 5.7 database service for WordPress, configured with environment variables from .env.

docker-compose.yml:4-15

wordpress

web applicationvulnerable target

WordPress service built from a Dockerfile that installs the NotificationX 2.8.2 plugin. Exposes port 80 to the host. The plugin contains a SQL injection vulnerability targeted by the exploit.

docker-compose.yml:18-35Dockerfile:1-10

exploit.py

exploit script

Python script that performs a time-based blind SQL injection against the NotificationX analytics endpoint to extract the WordPress admin password hash.

exploit.py:1-33
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-1698

Supported by supplied evidence

The environment installs NotificationX 2.8.2, which is the vulnerable version for CVE-2024-1698 (SQL injection). The README and exploit.py demonstrate a SQL injection attack against the plugin's analytics endpoint, consistent with the CVE description.

Dockerfile:6-9README.md:11-17exploit.py:1-33
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:3-5
  • The .env file with database credentials must be present.docker-compose.yml:9docker-compose.yml:28
  • The WordPress instance must be fully initialized with a user (admin) in the wp_users table for the exploit to extract a password hash.exploit.py:18

Evidence-described exercise path

  1. Build and start the environment with 'docker-compose up --build'.README.md:3-5
  2. Run the provided curl command or exploit.py script to perform a time-based blind SQL injection against the NotificationX analytics endpoint.README.md:11-17exploit.py:1-33
  3. Observe the extracted admin password hash from the response timing.exploit.py:27-33
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The exploit targets the local WordPress container via the exposed port 80, which is expected for demonstrating the SQL injection. No evidence of host escape, external connections, persistence, credential theft beyond the lab's own database, or destructive behavior is present.

docker-compose.yml:1-40Dockerfile:1-10exploit.py:1-33
Review boundaries

What the analysis did not establish

  • The Dockerfile downloads a plugin zip from an external URL (https://downloads.wordpress.org/plugin/notificationx.2.8.2.zip); the content of that zip is not inspected, but the URL is the official WordPress plugin repository.
  • The exploit.py script is provided as a text file; its behavior is visible and matches the described vulnerability exercise.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1