Canto plugin for WordPress <=3.0.4 - RCE
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2023-3452. PoCs published by leoanggal1, puppetma4ster, Alpastx. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits a Remote File Inclusion (RFI) vulnerability in the WordPress Canto plugin (CVE-2023-3452) via the 'wp_abspath' parameter, allowing unauthenticated attackers to execute arbitrary code if 'allow_url_include' is enabled. The exploit automates the process by hosting a malicious 'admin.php' file and triggering its inclusion on the target server.
Description
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
Exploits (3)
This PoC exploits a Remote File Inclusion (RFI) vulnerability in the WordPress Canto plugin (CVE-2023-3452) via the 'wp_abspath' parameter, allowing unauthenticated attackers to execute arbitrary code if 'allow_url_include' is enabled. The exploit automates the process by hosting a malicious 'admin.php' file and triggering its inclusion on the target server.
This repository contains a functional Metasploit module that exploits CVE-2023-3452 and CVE-2024-25096, which are remote file inclusion vulnerabilities in the WordPress Canto plugin. The exploit leverages unsanitized parameters (`abspath` and `wp_abspath`) to achieve remote code execution when `allow_url_include` is enabled in PHP.
This repository contains a functional Python exploit for CVE-2023-3452, targeting an RFI vulnerability in the WordPress Canto Plugin (≤ 3.0.4). The exploit includes a local HTTP server to serve a malicious PHP payload and supports both HTTP and HTTPS targets by disabling SSL verification.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H