CVE-2024-1813

CRITICAL

Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-1813 has a selected CVSS score of 9.8 (critical); EIP currently links 2 repository PoCs and 1 lab environment.

Description

The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job application is viewed.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 4, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Simple Job Board

Browse presstigers / Simple Job Board

Default status: unaffected

CVE ListThrough 2.11.0affected

Proofs of concept

2

Repository PoCs

GitHubMobetaSec/CVE-2024-1813-POCRepository PoCby MobetaSec0Exploit8 files

1.3 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is an end-to-end exploit for CVE-2024-1813. It includes a Python script (sjb_cve_2024_1813.py) that builds a serialized PHP object payload using a Monolog/RCE1 gadget chain, encodes it to bypass sanitization, and submits it via an unauthenticated HTTP POST to a vulnerable WordPress plugin. The README provides instructions to run the script and trigger the deserialization, resulting in remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python PoC script for CVE-2024-1813. The script builds and sends a serialized PHP object to exploit a known vulnerability in the Simple Job Board WordPress plugin. All behavior is consistent with the stated exploit: it constructs a Monolog/RCE1 gadget chain, encodes it for transport, and submits it via a public application form. No concealed backdoor, unrelated payload, or operator-directed harm beyond the declared exploit is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespythonmarkdown
Target softwarewordpresssimple_job_board
Attack typesphp_object_injectionremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively builds and delivers a malicious serialized PHP object to a vulnerable endpoint, with the stated purpose of achieving remote code execution. The README explicitly describes it as an 'exploit' and provides end-to-end instructions for running it against a target. This constitutes exploit code, not merely a scanner or writeup.

README.md:1README.md:5-7README.md:64-75sjb_cve_2024_1813.py:1-18

Requirements

  • Target must run Simple Job Board plugin version <= 2.11.0 and have a third-party plugin (e.g., All In One SEO) providing a POP gadget chain.README.md:10-14README.md:52-54
  • Attacker needs a valid job_id from the target WordPress site.sjb_cve_2024_1813.py:11sjb_cve_2024_1813.py:196

Observed behavior

  • The Python script builds a serialized PHP object payload containing a Monolog/RCE1 gadget chain that executes an arbitrary system command.sjb_cve_2024_1813.py:42-75
  • The script encodes the payload to bypass WordPress sanitization (e.g., using PHP's S: format for strings with null bytes, and double backslashes).sjb_cve_2024_1813.py:78-114
  • The script fetches a wp_nonce from the target job page and submits the malicious payload via an unauthenticated POST request to /wp-admin/admin-ajax.php.sjb_cve_2024_1813.py:117-133sjb_cve_2024_1813.py:165-189
  • The README instructs the user to run the script to store the payload and then trigger the deserialization by simulating an admin viewing the applicants list, resulting in command execution.README.md:66-75
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the normal behavior of the described CVE-2024-1813 exploit. The command is provided by the operator as a CLI argument and is not hardcoded.sjb_cve_2024_1813.py:42-75sjb_cve_2024_1813.py:197
Network Activity
Payload withheldThis is the expected delivery mechanism for the exploit against the vulnerable plugin.sjb_cve_2024_1813.py:165-189
Payload Encoding
Payload withheldThese encoding steps are necessary for the exploit to work and are not indicative of hidden behavior.sjb_cve_2024_1813.py:78-114
Review boundaries

What the analysis did not establish

  • The evidence includes only two text files (README.md and sjb_cve_2024_1813.py) out of eight total files. The remaining files, including lab setup scripts and a GIF demo, are not provided as text, limiting full verification of the lab environment.
  • The analysis is based solely on static code review; the exploit code was not executed, and its effectiveness is not verified.
  • Six files in the repository were not included in the text evidence (metadata only). Their content is unknown.
  • One non-text media file (poc.gif) was not analyzed.
  • The review is limited to the supplied text; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubwebshellseo8/CVE-2024-1813-Proof-of-ConceptRepository PoCby webshellseo80Writeup1 file

2.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file that describes CVE-2024-1813, a PHP Object Injection vulnerability in the Simple Job Board WordPress plugin. It provides an overview, intended audience, and expected outcomes for a Proof of Concept, but explicitly states the PoC code is not hosted in the repository. The file contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The repository contains only a README.md file with vulnerability documentation, a Telegram channel link, and a disclaimer. No executable code, payload, or backdoor behavior is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesMarkdown
Target softwareSimple Job Board WordPress Plugin
Attack typesPHP Object Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a documentation file (README.md) that provides a technical overview of CVE-2024-1813. It states 'The PoC itself is not hosted in this repository' (line 30) and contains no executable code, making it a writeup rather than an exploit or scanner.

README.md:30

Requirements

  • Target must be running Simple Job Board plugin version <= 2.11.0README.md:7
  • A suitable POP chain must be present via an additional plugin or theme for high impactREADME.md:9

Observed behavior

  • Describes the vulnerability and its potential impact, but does not perform any actionsREADME.md:1-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

External Link
Payload withheldTelegram channel link for security updates; no backdoor behavior in the artifact itself.README.md:37-44
Review boundaries

What the analysis did not establish

  • Evidence consists of a single README.md file; no other source code or files were provided.
  • The artifact explicitly states the PoC is not included, so the actual exploit or scanner code is absent.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot. The PoC itself is stated to be not hosted in this repository, so its behavior cannot be assessed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

lab/docker-compose.yml

MobetaSec/CVE-2024-1813-POCCreated Vuln labCVE-2024-1813Compose · images

1 Compose manifest · 4 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that reproduces CVE-2024-1813, an unauthenticated PHP Object Injection in the Simple Job Board WordPress plugin. It consists of a MariaDB database, a WordPress 6.9.4 Apache container with the vulnerable plugin and a gadget-chain plugin, a one-shot setup service, and an optional CLI service.

lab/docker-compose.yml:1-105

Lab assessment

Vulnerability lab

The Compose file explicitly declares itself a 'CVE-2024-1813 reproduction lab' and provisions a specific vulnerable plugin version (Simple Job Board 2.10.8) alongside a gadget-chain plugin (All In One SEO 4.5.6). The README and setup script describe the exploit steps and the trigger script simulates the admin action that fires the sink.

lab/docker-compose.yml:1-4README.md:1-3lab/setup/setup.sh:1-4
Lab shapeCompose · images
Services4
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MariaDB 10.11 database service that stores WordPress data. It uses a named volume for persistence and a healthcheck to signal readiness.

lab/docker-compose.yml:30-42

wordpress

web servervulnerable target

WordPress 6.9.4 with PHP 8.3 and Apache, exposed on host port 8081. It mounts a named volume for the web root and enables debug logging. The setup service later installs the vulnerable Simple Job Board plugin and the gadget-chain plugin into this container.

lab/docker-compose.yml:44-63

setup

provisioning

One-shot service that runs a shell script to install WordPress core, the two required plugins (Simple Job Board 2.10.8 and All In One SEO 4.5.6), and a published job post. It exits after printing the lab URLs and credentials.

lab/docker-compose.yml:65-85lab/setup/setup.sh:1-63

cli

utility

Optional wp-cli service (profile 'tools') that shares the WordPress volume and can be used for manual inspection, e.g., listing job posts. It does not start automatically.

lab/docker-compose.yml:87-100
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-1813

Supported by supplied evidence

The lab explicitly names CVE-2024-1813, provisions the vulnerable plugin version (Simple Job Board 2.10.8), and includes a trigger script that simulates the admin action required to fire the deserialization sink. The README describes the vulnerability as unauthenticated PHP Object Injection and references the official WPScan and Wordfence entries for this CVE.

lab/docker-compose.yml:1-4README.md:1-3README.md:10-18lab/trigger_exploit.sh:1-4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab.README.md:24-25
  • Python 3.7+ is required to run the PoC script (sjb_cve_2024_1813.py).README.md:24
  • The lab must be started with 'docker compose up -d' and the setup service must complete successfully, providing a job_id.README.md:42-44lab/setup/setup.sh:55-63

Evidence-described exercise path

  1. Start the lab: 'cd lab && docker compose up -d'. The setup service installs WordPress, the vulnerable plugins, and creates a job post, printing the job_id.README.md:42-44lab/setup/setup.sh:55-63
  2. Run the PoC to store the serialized payload: 'python3 sjb_cve_2024_1813.py http://localhost:8081 <job_id> 'id > /tmp/RCE_PROOF.txt''.README.md:49-50
  3. Simulate the admin trigger by running './trigger_exploit.sh', which logs in as admin and visits the applicants list page, causing the deserialization sink to fire.README.md:52-53lab/trigger_exploit.sh:1-4
  4. Verify command execution: 'docker exec sjb_lab_wp cat /tmp/RCE_PROOF.txt'.README.md:55-56
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers and the documented exploit exercise. The Compose file maps port 8081 to the WordPress container, which is necessary for accessing the target. The setup script downloads plugins from the official WordPress.org repository and installs them inside the WordPress container. The trigger script uses curl to interact with the local WordPress instance and runs a docker exec command to read a proof file inside the target container. No evidence shows host escape, external connections beyond the declared plugin downloads, persistence outside the lab volumes, credential theft, or destructive actions.

lab/docker-compose.yml:1-105lab/setup/setup.sh:1-63lab/trigger_exploit.sh:1-67README.md:1-107
Review boundaries

What the analysis did not establish

  • The PoC script (sjb_cve_2024_1813.py) is referenced but not included in the evidence packet; its exact behavior cannot be verified.
  • The lab uses hardcoded credentials (admin/admin123!) and downloads plugins over HTTP, which are acceptable in a throwaway lab but would be dangerous in production.
  • The trigger script runs 'docker compose run --rm -T cli' and 'docker exec sjb_lab_wp cat /tmp/RCE_PROOF.txt', which require Docker access on the host; this is expected for a lab but means the host must have Docker installed and the user must have permission to interact with the Docker daemon.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3