CVE-2022-1609
CRITICAL EXPLOITED IN THE WILD NUCLEISchool Management WordPress Plugin < 9.9.7 - Unauthenticated Remote Code Execution via Backdoor REST API Handler
Title source: llmExploitation Summary
CVE-2022-1609 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 5 public exploits from researchers including 0xSojalSec, itworksig, savior-only. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages a backdoor in the Weblizar WordPress plugin to execute arbitrary system commands via a crafted POST request to the `/wp-json/am-member/license` endpoint. The script provides an interactive shell by injecting commands into the `blowf` parameter.
Description
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
Exploits (5)
This exploit leverages a backdoor in the Weblizar WordPress plugin to execute arbitrary system commands via a crafted POST request to the `/wp-json/am-member/license` endpoint. The script provides an interactive shell by injecting commands into the `blowf` parameter.
This is a functional exploit for CVE-2022-1609, targeting a WordPress Weblizar plugin backdoor. It leverages an arbitrary command execution vulnerability via the `/wp-json/am-member/license` endpoint by injecting commands into the `blowf` parameter.
This PoC demonstrates a remote command execution (RCE) vulnerability in WordPress Weblizar via a backdoor in the REST API endpoint. The exploit sends a crafted POST request to execute arbitrary system commands.
This exploit leverages a backdoor in the Weblizar plugin for WordPress (CVE-2022-1609) to achieve remote command execution via a crafted POST request to the `/wp-json/am-member/license` endpoint. The script sends arbitrary commands through the `blowf` parameter, which are executed on the target system.
This repository contains a functional exploit for CVE-2022-1609, a backdoor in the Weblizar WordPress plugin. The exploit sends a crafted POST request to the vulnerable API endpoint to achieve remote code execution (RCE).
Nuclei Templates (1)
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H