{"id":22799796,"url":"https://github.com/chocapikk/cve-2024-5084","last_synced_at":"2025-04-19T16:44:00.458Z","repository":{"id":241570438,"uuid":"806742640","full_name":"Chocapikk/CVE-2024-5084","owner":"Chocapikk","description":"Hash Form – Drag \u0026 Drop Form Builder \u003c= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution","archived":false,"fork":false,"pushed_at":"2024-07-17T23:40:18.000Z","size":5,"stargazers_count":7,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-29T10:23:07.448Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Chocapikk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-27T20:04:10.000Z","updated_at":"2025-03-18T17:59:18.000Z","dependencies_parsed_at":"2024-06-04T12:49:09.608Z","dependency_job_id":null,"html_url":"https://github.com/Chocapikk/CVE-2024-5084","commit_stats":null,"previous_names":["chocapikk/cve-2024-5084"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2024-5084","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2024-5084/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2024-5084/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2024-5084/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Chocapikk","download_url":"https://codeload.github.com/Chocapikk/CVE-2024-5084/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249740833,"owners_count":21318709,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-12T07:09:59.379Z","updated_at":"2025-04-19T16:44:00.440Z","avatar_url":"https://github.com/Chocapikk.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🚀 HashForm Exploit Script\n\nThis script demonstrates the exploitation of CVE-2024-5084, a vulnerability in the Hash Form plugin for WordPress, which allows unauthenticated arbitrary file upload leading to remote code execution.\n\n## 📖 Vulnerability Details\n\n- **Name**: CVE-2024-5084\n- **Description**: Unauthenticated Arbitrary File Upload to Remote Code Execution.\n- **Affected Plugin**: Hash Form – Drag \u0026 Drop Form Builder \u003c= 1.1.0\n- **Source**: [Wordfence - Vulnerability Details](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hash-form/hash-form-drag-drop-form-builder-110-unauthenticated-arbitrary-file-upload-to-remote-code-execution)\n\n## ⚙️ Installation\n\n1. Clone the repository:\n   ```bash\n   git clone https://github.com/Chocapikk/CVE-2024-5084.git\n   cd CVE-2024-5084\n   ```\n\n2. Install the required dependencies:\n   ```bash\n   pip install -r requirements.txt\n   ```\n\n## 🚀 Usage\n\n1. Run the script:\n   ```bash\n   python exploit.py --url \"http://target-site.com\"\n   ```\n\n   Replace `http://target-site.com` with the base URL of the WordPress site you want to test.\n\n2. If the upload is successful, you will enter an interactive shell to execute commands on the server.\n\n## 🔍 Dorks\n\n- **ZoomEye**: `banner:\"var hashform_vars\"`\n\n## ⚠️ Disclaimer\n\n**Disclaimer**: This script is intended for educational purposes only. Unauthorized use of this script on systems you do not own or do not have explicit permission to test is illegal and unethical. The author is not responsible for any misuse of this script.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchocapikk%2Fcve-2024-5084","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchocapikk%2Fcve-2024-5084","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchocapikk%2Fcve-2024-5084/lists"}