CVE-2024-9933
CRITICALWatchTowerHQ <= 3.10.1 - Unauthenticated Authentication Bypass via Empty OTA Token
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-9933. PoCs published by Boshe99, Nxploited, RandomRobbieBF.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2024-9933, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
Description
The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.10.1. This is due to the 'watchtower_ota_token' default value is empty, and the not empty check is missing in the 'Password_Less_Access::login' function. This makes it possible for unauthenticated attackers to log in to the WatchTowerHQ client administrator user.
Exploits (3)
The repository contains functional exploit code for CVE-2024-9933, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
This PoC exploits an authentication bypass vulnerability in the WatchtowerHQ WordPress plugin (version 3.10.1) by manipulating the `wht_login` and `access_token` parameters. It includes both a version checker and an exploit function to confirm vulnerability and trigger the bypass.
This PoC demonstrates an authentication bypass vulnerability in WatchTowerHQ WordPress plugin <= 3.10.1 due to a missing empty value check for the 'watchtower_ota_token'. Unauthenticated attackers can log in as administrator by accessing a specific URL.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H