Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via job_board_applicant_list_columns_value
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-1813. PoCs published by MobetaSec.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-1813, demonstrating unauthenticated PHP object injection in Simple Job Board <= 2.11.0. The PoC stores a serialized payload via the public application form and triggers RCE when an admin views the applicants list.
Description
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job application is viewed.
Exploits (1)
This repository contains a functional exploit for CVE-2024-1813, demonstrating unauthenticated PHP object injection in Simple Job Board <= 2.11.0. The PoC stores a serialized payload via the public application form and triggers RCE when an admin views the applicants list.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H