CVE-2024-6460
CRITICAL NUCLEIGrow by Tradedoubler <2.0.21 - Code Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-6460. PoCs published by Boshe99, E1-Bot141, Nxploited. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2024-6460, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
Description
The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Exploits (3)
The repository contains functional exploit code for CVE-2024-6460, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
The repository contains only a README.md file with a usage description for an exploit script (CVE-2024-6460.py) targeting Grow by Tradedoubler < 2.0.22 for an unauthenticated LFI vulnerability. However, the actual exploit code is missing, making this a stub.
This PoC exploits an LFI vulnerability in the Grow by Tradedoubler WordPress plugin (versions < 2.0.22) by leveraging an authenticated AJAX endpoint to read arbitrary files. It includes version checking and authentication handling.
Nuclei Templates (1)
body="wp-content/plugins/tradedoubler-affiliate-tracker/"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H