Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection via Untrusted Input Deserialization
Title source: llmExploitation Summary
CVE-2023-6933 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Trex96, w2xim3. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Proof-of-Concept for CVE-2023-6933, demonstrating a PHP Object Injection vulnerability in the Better Search Replace WordPress plugin. The PoC includes a Nuclei template for detection and exploitation, along with detailed documentation and a Docker environment for testing.
Description
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Exploits (2)
This repository contains a functional Proof-of-Concept for CVE-2023-6933, demonstrating a PHP Object Injection vulnerability in the Better Search Replace WordPress plugin. The PoC includes a Nuclei template for detection and exploitation, along with detailed documentation and a Docker environment for testing.
This repository provides a detailed technical analysis of CVE-2023-6933, a PHP Object Injection vulnerability in the 'Better Search Replace' WordPress plugin. It includes a step-by-step breakdown of the exploitation process, leveraging the `WP_HTML_Token` class in WordPress 6.4.0 to achieve remote code execution (RCE) through deserialization.
Nuclei Templates (1)
body="/wp-content/plugins/better-search-replace/"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H