CVE-2024-9593
HIGH EXPLOITED NUCLEITime Clock and Time Clock Pro <= 1.2.2 - Unauthenticated Remote Code Execution via etimeclockwp_load_function_callback
Title source: llmExploitation Summary
CVE-2024-9593 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including RandomRobbieBF, 0x4f5da2-venom, Nxploited. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates an unauthenticated remote code execution vulnerability in the Time Clock and Time Clock Pro WordPress plugins via the 'etimeclockwp_load_function_callback' function. The exploit sends a POST request to admin-ajax.php with a specified function name to execute arbitrary code.
Description
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
Exploits (4)
This PoC demonstrates an unauthenticated remote code execution vulnerability in the Time Clock and Time Clock Pro WordPress plugins via the 'etimeclockwp_load_function_callback' function. The exploit sends a POST request to admin-ajax.php with a specified function name to execute arbitrary code.
This is a scanner for CVE-2024-9593, a WordPress plugin vulnerability. It checks for the presence of the vulnerability by sending a POST request to a specific endpoint and analyzing the response for indicators of vulnerability.
This exploit targets CVE-2024-9593, an unauthenticated Remote Code Execution vulnerability in the Time Clock and Time Clock Pro WordPress plugins. It checks for vulnerable versions by fetching the readme.txt file and then exploits the vulnerability via the 'etimeclockwp_load_function_callback' function.
The repository contains functional exploit code for CVE-2024-9593, targeting an arbitrary file upload vulnerability in the WordPress Plugin 3DPrint Lite 1.9.1.4. The exploit demonstrates the ability to upload a malicious file to a vulnerable target.
Nuclei Templates (1)
body="/wp-content/plugins/time-clock/" || body="/wp-content/plugins/time-clock-pro/"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L