## https://sploitus.com/exploit?id=E5580B43-3A14-57DD-A63A-97D8D7F1A3C8
# Poc LiteSpeed Cache CVE-2024-44000 Exploit
CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data.
------------------------------------------------------
------------------------------------------------------
The script works in the following steps:
1. **Extract Cookies from Debug Log**:
- The script sends a `GET` request to retrieve the `debug.log` file (`wp-content/debug.log`) from the server.
- It uses regular expressions to extract cookies from the file's contents.
2. **Extract Session Cookies**:
- It filters the extracted cookies to locate session cookies matching the pattern:
```
wordpress_logged_in_[^=]+=[^;]+
```
3. **Hijack Admin Session**:
- The script generates URLs with the stolen cookies and sends a `GET` request to the WordPress admin dashboard (`wp-admin/`).
- If the response includes a `302 Redirect` with a `Location` header containing the `wp-admin` path, it considers the hijacking successful.
## Factors Affecting Script Success
Several factors influence the effectiveness of this script:
- **Debug Log File Accessibility**: The script assumes that the `debug.log` file is publicly accessible and contains session cookies. If this is not the case, the script will not work.
- **Cookie Extraction and Filtering**: The regular expressions used for extracting cookies may not catch all possible formats or variations of session cookies.
## Disclaimer
**Important:** Exploiting vulnerabilities without permission is illegal and unethical. This script is intended for **educational and testing purposes only**. Use it only with explicit consent from the system owner.