Exploitation Summary
EIP tracks 2 public exploits for CVE-2021-39352.
PoCs published by Ron Jost, h00die, Ron Jost, Thinkland Security Team, including Metasploit module exploits/multi/http/wp_catch_themes_demo_import.
AI-analyzed exploit summary This exploit targets a file upload vulnerability in the WordPress Catch Themes Demo Import plugin (CVE-2021-39352), allowing authenticated attackers to upload a malicious PHP shell for remote code execution. The PoC includes authentication, nonce extraction, and a multipart form upload of a p0wny shell.
Description
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.
Exploits (2)
This exploit targets a file upload vulnerability in the WordPress Catch Themes Demo Import plugin (CVE-2021-39352), allowing authenticated attackers to upload a malicious PHP shell for remote code execution. The PoC includes authentication, nonce extraction, and a multipart form upload of a p0wny shell.
This Metasploit module exploits an authenticated arbitrary file upload vulnerability in the WordPress plugin Catch Themes Demo Import (versions < 1.8). It uploads a malicious PHP payload via the import functionality and triggers it to achieve remote code execution.
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H