Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-9290. PoCs published by Jenderal92, RandomRobbieBF.
AI-analyzed exploit summary This exploit targets a file upload vulnerability in the Super Backup & Clone WordPress plugin (CVE-2024-9290), allowing arbitrary PHP file uploads to `/wp-content/uploads/isnapshots/`. It uses multi-threading to process multiple targets and logs successful exploits.
Description
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (2)
This exploit targets a file upload vulnerability in the Super Backup & Clone WordPress plugin (CVE-2024-9290), allowing arbitrary PHP file uploads to `/wp-content/uploads/isnapshots/`. It uses multi-threading to process multiple targets and logs successful exploits.
This PoC demonstrates an unauthenticated arbitrary file upload vulnerability in the Super Backup & Clone - Migrate for WordPress plugin (CVE-2024-9290). The exploit leverages a missing capability check and file type validation in the `ibk_restore_migrate_check()` function to upload a malicious PHP file, leading to potential remote code execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H