## https://sploitus.com/exploit?id=461F8284-E974-50E8-A704-1004B9E4FB9D
🚀 HashForm Exploit – Lab Demo
This repository contains a proof-of-concept exploit for CVE-2024-5084, a vulnerability found in the Hash Form WordPress plugin.
It’s meant only for learning, lab testing, and security research.
📌 About the Vulnerability
CVE ID: CVE-2024-5084
Issue: Unauthenticated file upload → Remote Code Execution
Plugin: Hash Form – Drag & Drop Form Builder (≤ 1.1.0)
Impact: Allows attackers to upload a malicious file and execute system commands
This lab demonstrates how insecure file upload handling can lead to full server compromise.
🧪 Lab Setup (Local / Practice Only)
Recommended environment:
Windows or Linux VM
XAMPP / LAMP / WAMP
WordPress (latest)
Vulnerable Hash Form plugin version (≤ 1.1.0)
Steps (high level):
Install Apache Xampp with myphp
Install WordPress on your local VM
Install and activate the vulnerable Hash Form plugin
Ensure the site is reachable from your testing machine
Use this script to test and understand the vulnerability
💡 Tip: Use VMware / VirtualBox and never expose this setup to the internet.
⚙️ Installation
Clone the repository:
git clone https://github.com/RedTeamBlueTeam/CVE-2024-5084-Red-Team.git
cd CVE-2024-5084-Red-Team
Install dependencies:
pip install -r requirements.txt
▶️ Usage
Run the exploit script:
python exploit.py -u http://localhost/wordpress/
for explae --> python exploit.py -u http://192.169.100.101/wordpress/
If the target is vulnerable:
A PHP file will be uploaded
You’ll get an interactive command shell
Commands are executed through the command shell.
Type exit to quit the shell.
📚 What You’ll Learn
How unauthenticated file uploads are abused
Why input validation matters
How WordPress plugins become attack vectors
Basics of post-exploitation command execution
⚠️ Disclaimer
This project is for educational and lab testing purposes only.
Do NOT use this against systems you don’t own or don’t have written permission to test.
I am not responsible for any misuse or damage caused by this code.