Share 
## https://sploitus.com/exploit?id=75A80894-FF09-562D-B0FF-5F1381E02B59
# CVE-2024-1071 Exploit Script πŸš€

## 🌟 Disclaimer
**This Proof of Concept (POC) is made for educational and ethical testing purposes only.**  
Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

## Overview
The WordPress **Ultimate Member** plugin (versions 2.1.3 to 2.8.2) has a **SQL Injection vulnerability** through the `sorting` parameter. This occurs due to insufficient input validation and unprepared SQL queries, allowing unauthenticated users to manipulate queries and extract sensitive data from affected databases.

**Affected Plugin Versions:** 2.1.3 to 2.8.2  
**Severity:** High  
**CVE ID:** CVE-2024-1071

## PoC Status
**PoC is now published. It was created for educational/research purposes only! Use it at your own risk!**
- NOT VULNERABLE!
  ![Not Vulnerable!](https://github.com/user-attachments/assets/9c42a904-7a02-436a-85f7-1e4cf35b4c7f)
- VULNERABLE! 
  ![Vulnerable!](https://github.com/user-attachments/assets/4f066180-3834-492e-b0b3-00b4744e019d)



## πŸ” Finding Potential Targets
Identify potential targets with tools like **FOFA** or **Shodan.io** using the following dorks:

- **FOFA Dork**: `body="/wp-content/plugins/ultimate-member"`
- **Hunter Dork**: `body="/wp-content/plugins/ultimate-member"`

## πŸ“¦ Cloning the Repository
To get started, clone the repository using the following commands:

 `git clone https://github.com/Spid3heX/CVE-2024-1071-PoC-Script.git` 
 `cd CVE-2024-1071-PoC-Script`

## βš™οΈ Usage
The script can scan either a single target URL or multiple URLs listed in a file. It will evaluate each target for vulnerability and provide feedback.
- **Command Line Arguments**
-f, --file: Specify a text file containing a list of target URLs to scan.

- **To scan a single target URL:**
 `python cve-2024-1071.py https://example.com`

- **To scan multiple targets from a file:**
 `python cve-2024-1071.py -f targets.txt`