{"id":27155491,"url":"https://github.com/so1icitx/cve-2024-25600","last_synced_at":"2025-04-08T19:41:13.672Z","repository":{"id":285338408,"uuid":"957779435","full_name":"so1icitx/CVE-2024-25600","owner":"so1icitx","description":"Unauthenticated RCE exploit for CVE-2024-25600 in WordPress Bricks Builder \u003c= 1.9.6. Executes arbitrary code remotely.","archived":false,"fork":false,"pushed_at":"2025-04-05T16:28:22.000Z","size":24,"stargazers_count":8,"open_issues_count":0,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-08T10:51:38.890Z","etag":null,"topics":["bricks-builder","bricksbuilder","cve-2024-25600","exploit","hacking","pentesting","python-3","python3","rce","rce-exploit","remote-code-execution","security-research","security-researcher","vulnerability","wordpress","wordpress-plugin"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/so1icitx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-03-31T05:44:43.000Z","updated_at":"2025-04-07T00:36:59.000Z","dependencies_parsed_at":"2025-03-31T06:28:27.583Z","dependency_job_id":"332aeb39-c91f-44ee-87f7-56ba1242c474","html_url":"https://github.com/so1icitx/CVE-2024-25600","commit_stats":null,"previous_names":["so1icitx/cve-2024-25600"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/so1icitx%2FCVE-2024-25600","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/so1icitx%2FCVE-2024-25600/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/so1icitx%2FCVE-2024-25600/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/so1icitx%2FCVE-2024-25600/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/so1icitx","download_url":"https://codeload.github.com/so1icitx/CVE-2024-25600/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247913982,"owners_count":21017233,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bricks-builder","bricksbuilder","cve-2024-25600","exploit","hacking","pentesting","python-3","python3","rce","rce-exploit","remote-code-execution","security-research","security-researcher","vulnerability","wordpress","wordpress-plugin"],"created_at":"2025-04-08T19:41:12.935Z","updated_at":"2025-04-08T19:41:13.663Z","avatar_url":"https://github.com/so1icitx.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2024-25600 Exploit - WordPress Bricks Builder Remote Code Execution (RCE) \n\nAn exploit script for **CVE-2024-25600**, a critical **unauthenticated Remote Code Execution (RCE)** vulnerability in the **Bricks Builder plugin** for **WordPress**. This tool detects the flaw, extracts the nonce, and provides an **interactive shell** for executing arbitrary commands on vulnerable targets. Tested on **Bricks Builder version 1.9.5**, it affects all versions up to and including **1.9.6**. This **security flaw** allows attackers to remotely inject and execute **malicious PHP code** without authentication, potentially leading to **full site compromise**, **data theft**, or **malware distribution**.\n\n## Author\n- **so1icitx**\n\n## Features\n- Tests **WordPress** sites for **CVE-2024-25600** vulnerability by fetching the nonce and verifying **RCE** capability.\n- Supports single URL and bulk scanning from a file for **vulnerable Bricks Builder** instances.\n- Launches an **interactive shell** for **remote command execution** on confirmed targets.\n- Multi-threaded scanning (100 threads) for efficient **vulnerability detection**.\n- Verbose mode for detailed output during **exploit attempts**.\n- Saves **vulnerable URLs** to an output file for further analysis.\n\n## Prerequisites\n- **Python 3.6+**\n- Required packages:\n  ```bash\n  pip install requests beautifulsoup4 prompt_toolkit\n  ```\n\n## Usage\n```bash\npython3 exploit.py -u \u003ctarget_url\u003e [options]\n```\n\n### Options\n- `-u, --url`: Target **WordPress** URL (e.g., `http://example.com`) - required for single scan.\n- `-l, --list`: Path to a file with a list of URLs for bulk **RCE scanning** (optional).\n- `-o, --output`: File to save **vulnerable WordPress URLs** (optional).\n\n### Examples\n- Basic **RCE exploit**:\n  ```bash\n  python3 exploit.py -u http://10.10.10.10\n  ```\n- Bulk **vulnerability scanning**:\n  ```bash\n  python3 exploit.py -l targets.txt -o vulnerable.txt\n  ```\n- **Interactive shell** (triggered on vulnerable targets):\n  ```bash\n  # whoami\n  # exit\n  ```\n\n## Notes\n- Targets must use the **Bricks Builder plugin** with the vulnerable `/wp-json/bricks/v1/render_element` endpoint.\n- Exploits a flaw in user input handling, enabling **unauthenticated attackers** to execute **arbitrary PHP code**.\n- Uses 100 threads for bulk scans; adjust `max_workers` in the script for performance tweaks.\n- SSL verification is disabled to handle self-signed certificates on **WordPress sites**.\n- Use responsibly on authorized systems only to avoid **site compromise** or **malware risks**.\n- Contact me at `so1citix.zone242@passinbox.com` for support or issues!\n\n## Disclaimer\nThis tool is for **educational** and **authorized security testing** purposes only. Unauthorized exploitation of **CVE-2024-25600** is illegal and unethical.\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fso1icitx%2Fcve-2024-25600","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fso1icitx%2Fcve-2024-25600","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fso1icitx%2Fcve-2024-25600/lists"}