CVE-2024-12849
HIGH NUCLEIError Log Viewer By WP Guru <1.0.1.3 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-12849. PoCs published by Boshe99, Nxploited, RandomRobbieBF. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2024-12849, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
Description
The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Exploits (3)
The repository contains functional exploit code for CVE-2024-12849, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
This repository contains a functional exploit for CVE-2024-12849, which targets an arbitrary file read vulnerability in the Error Log Viewer By WP Guru WordPress plugin. The exploit checks the plugin version and performs unauthenticated file reads via the `wp_ajax_nopriv_elvwp_log_download` AJAX action.
The repository contains a functional proof-of-concept for CVE-2024-12849, demonstrating an unauthenticated arbitrary file read vulnerability in the Error Log Viewer By WP Guru WordPress plugin. The exploit leverages the `wp_ajax_nopriv_elvwp_log_download` AJAX action to read sensitive files like `/etc/passwd`.
Nuclei Templates (1)
http.html:"wp-content/plugins/error-log-viewer-wp"
body="wp-content/plugins/error-log-viewer-wp"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N