Exploitation Summary
EIP tracks 4 public exploits for CVE-2024-9932. PoCs published by RandomRobbieBF, JoshuaProvoste, Boshe99.
AI-analyzed exploit summary This PoC demonstrates an unauthenticated arbitrary file upload vulnerability in Wux Blog Editor for WordPress <= 3.0.0. The exploit leverages insufficient file type validation in the 'wuxbt_insertImageNew' function, allowing remote code execution via a crafted HTTP POST request.
Description
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (4)
This PoC demonstrates an unauthenticated arbitrary file upload vulnerability in Wux Blog Editor for WordPress <= 3.0.0. The exploit leverages insufficient file type validation in the 'wuxbt_insertImageNew' function, allowing remote code execution via a crafted HTTP POST request.
This is a functional exploit for CVE-2024-9932, an unauthenticated arbitrary file upload vulnerability in the Wux Blog Editor WordPress plugin. It uploads a remote PHP payload via a vulnerable REST endpoint and provides an interactive shell for command execution.
The repository contains functional exploit code for CVE-2024-9932, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
This is a functional exploit for CVE-2024-9932, targeting an arbitrary file upload vulnerability in the Wux Blog Editor WordPress plugin (versions up to 3.0). The PoC checks the plugin version and exploits insufficient file type validation to upload a remote file to the server.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H