## https://sploitus.com/exploit?id=F4F4FD5B-8F2D-5583-B6E0-54CE49C8AB53
# Proof-Of-Concept Code for CVE-2024-8353
This repository contains a script for exploiting the CVE-2024-8353 vulnerability in the GiveWP plugin for WordPress. This vulnerability allows unauthenticated PHP Object Injection, potentially leading to remote code execution.
## Overview
The provided scripts demonstrate the exploit:
- **Python Script**: Automates the process of identifying vulnerable forms, retrieving nonces, and delivering payloads to trigger the vulnerability.
- **PHP Script**: Serves as a crafted payload to showcase the deserialization attack mechanics.
### Vulnerability Description
CVE-2024-8353 affects versions of the GiveWP plugin up to and including 3.16.1. The vulnerability arises due to improper handling of serialized input through parameters like `give_title` and `card_address`. Attackers can exploit this to inject and execute arbitrary PHP code.
## Prerequisites
- Python 3.x
- PHP 7.x or later
- Required Python packages listed in `requirements.txt`
## Usage
### Python Script
1. Install dependencies:
```bash
pip install -r requirements.txt
```
2. Example command:
```bash
python3 exploit.py --url https://target-wordpress-site.com --cmd "cat /etc/passwd"
```
3. Run the script:
```bash
pip install -r requirements.txt
```
2. Run the script:
```bash
python3 exploit.py --url <TARGET_URL> --cmd <COMMAND>
```
## Disclaimer
This repository is intended for educational purposes only. Use responsibly and only on systems you own or have explicit permission to test. The author is not responsible for any damage caused by the use of this exploit.
## Contributions
Contributions to improve the scripts or enhance their functionality are welcome. Please submit a pull request or create an issue for discussion.
## License
This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.