https://github.com/chocapikk/cve-2024-5084
Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
https://github.com/chocapikk/cve-2024-5084
Last synced: about 1 year ago
JSON representation
Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
- Host: GitHub
- URL: https://github.com/chocapikk/cve-2024-5084
- Owner: Chocapikk
- Created: 2024-05-27T20:04:10.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2024-07-17T23:40:18.000Z (almost 2 years ago)
- Last Synced: 2025-03-29T10:23:07.448Z (about 1 year ago)
- Language: Python
- Size: 4.88 KB
- Stars: 7
- Watchers: 2
- Forks: 6
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# 🚀 HashForm Exploit Script
This script demonstrates the exploitation of CVE-2024-5084, a vulnerability in the Hash Form plugin for WordPress, which allows unauthenticated arbitrary file upload leading to remote code execution.
## 📖 Vulnerability Details
- **Name**: CVE-2024-5084
- **Description**: Unauthenticated Arbitrary File Upload to Remote Code Execution.
- **Affected Plugin**: Hash Form – Drag & Drop Form Builder <= 1.1.0
- **Source**: [Wordfence - Vulnerability Details](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hash-form/hash-form-drag-drop-form-builder-110-unauthenticated-arbitrary-file-upload-to-remote-code-execution)
## ⚙️ Installation
1. Clone the repository:
```bash
git clone https://github.com/Chocapikk/CVE-2024-5084.git
cd CVE-2024-5084
```
2. Install the required dependencies:
```bash
pip install -r requirements.txt
```
## 🚀 Usage
1. Run the script:
```bash
python exploit.py --url "http://target-site.com"
```
Replace `http://target-site.com` with the base URL of the WordPress site you want to test.
2. If the upload is successful, you will enter an interactive shell to execute commands on the server.
## 🔍 Dorks
- **ZoomEye**: `banner:"var hashform_vars"`
## ⚠️ Disclaimer
**Disclaimer**: This script is intended for educational purposes only. Unauthorized use of this script on systems you do not own or do not have explicit permission to test is illegal and unethical. The author is not responsible for any misuse of this script.