CVE-2022-1329-WordPress-Elementor-RCE

CVE-2022-1329-WordPress-Elementor-RCE 该POC主要是基于AkuCyberSec的研究版本，并进行了一些补充。 使用说明 使用docker-compose开启漏洞环境： docker-compose up -d 然后可以在浏览器访问WordPress的管理页面http://localhost:8000/wp-admin，创建admin用户，然后在User 标签下创建一个其他用户，举个例子如下： 用户名| 密码| 角色 ---|---|--- wc| 123456| Admin a2| aaaaaa| Editor 使用admin帐号登录，在插件...

CVE-2022-1329

CVE-2022-1329 🦠 プロジェクトは Agustín Sánchez Martín と Enrique Sánchez-Migallón Ochoa が、Escuela Superior de Informática de Ciudad Real で Sebastián Reyes Ávila が担当する Seguridad en Sistemas Informáticos （コンピュータシステムセキュリティ）の授業のために開発しました。 このプロジェクトは、Ubuntu 20.04 マシンに事前に WordPress がインストールされた環境で、脆弱性 CVE-2022-13...

Exploit for Unrestricted Upload of File with Dangerous Type in Elementor Website_Builder

CVE-2022-1329 🦠 Proyecto desarrollado por Agustín Sánchez M...

CVE-2022-1329

The Elementor Website Builder plugin for WordPress (versions 3.6.0 to 3.6.2 ) is vulnerable to Remote Code Execution (RCE) due to a missing capability check in the ~/core/app/modules/onboarding/module.php file. An authenticated attacker can exploit this by calling the /wp-admin/admin-ajax.php end...

CVE-2022-1329 Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files...

CVE-2022-1329

creationtimestamp| type| source ---|---|--- 2022-04-17 06:23:53+00:00| published-proof-of-concept| https://t.me/proxybar/803 2022-04-17 22:20:29+00:00| published-proof-of-concept| https://t.me/MrVGunz/120 2022-04-18 04:21:33+00:00| published-proof-of-concept| https://t.me/LearnExploit/3397...

Exploit for Unrestricted Upload of File with Dangerous Type in Elementor Website_Builder

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Exe...

WordPress Elementor 3.6.2 Remote Code Execution Vulnerability

Description: Insufficient Access Control leading to Subscriber+ Remote Code Execution Affected Plugin: Elementor Plugin Slug: elementor Plugin Developer: Elementor Affected Versions: 3.6.0 – 3.6.2 CVE ID: CVE-2022-1329 CVSS Score: 9.9Critical CVSS Vector:...

Wordpress Plugin Elementor Authenticated Upload Remote Code Execution

The WordPress plugin Elementor versions 3.6.0 - 3.6.2, inclusive have a vulnerability that allows any authenticated user to upload and execute any PHP file. This is achieved by sending a request to install Elementor Pro from a user supplied zip file. Any user with Subscriber or more permissions i...