CVE-2024-10571
CRITICAL EXPLOITED NUCLEIChartify - WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via Source Parameter
Title source: llmExploitation Summary
CVE-2024-10571 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including RandomRobbieBF. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional proof-of-concept for CVE-2024-10571, demonstrating an unauthenticated Local File Inclusion (LFI) vulnerability in the Chartify WordPress plugin. The exploit leverages the 'source' parameter to include arbitrary files, potentially leading to remote code execution (RCE) if PHP files are accessible.
Description
The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Exploits (1)
The repository contains a functional proof-of-concept for CVE-2024-10571, demonstrating an unauthenticated Local File Inclusion (LFI) vulnerability in the Chartify WordPress plugin. The exploit leverages the 'source' parameter to include arbitrary files, potentially leading to remote code execution (RCE) if PHP files are accessible.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H