Web Directory Free WP <1.7.0 - SQL Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-3552. PoCs published by KiPhuong. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository provides a Docker-based challenge environment for CVE-2024-3552, simulating a vulnerable WordPress setup with the Akismet plugin. The exploit likely targets a vulnerability in the Akismet plugin, though the specific exploit code is not directly visible in the provided files.
Description
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
Exploits (2)
This repository provides a Docker-based challenge environment for CVE-2024-3552, simulating a vulnerable WordPress setup with the Akismet plugin. The exploit likely targets a vulnerability in the Akismet plugin, though the specific exploit code is not directly visible in the provided files.
This repository provides a detailed technical analysis of CVE-2024-3552, a SQL Injection vulnerability in the Web Directory Free WordPress plugin before version 1.7.0. It includes a root cause analysis, proof-of-concept payloads, and sqlmap verification, demonstrating the vulnerability in the `w2dc_ajax_controller` class's `get_map_marker_info` function.
Nuclei Templates (1)
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H