SQL Injection in ValvePress WP-Automatic

This repository contains a single Python script (main.py) that implements a mass exploitation tool for CVE-2024-27956, a vulnerability in the WordPress wp-automatic plugin. The script is designed to take a list of target domains and, using multithreading, test each for vulnerability by sending crafted POST requests to the /wp-content/plugins/wp-automatic/inc/csv.php endpoint. If a target is found vulnerable, the script attempts to exploit it by injecting SQL payloads that create a new WordPress user ('eviladmin') with a known password hash and then escalate this user to administrator privileges. The tool provides output on which domains are vulnerable, not vulnerable, or encountered errors, and can save results in JSON format. The exploit is operational, as it automates both detection and exploitation, and the payload is a hardcoded SQL command to create an admin user. The main attack vector is network-based, targeting accessible WordPress installations with the vulnerable plugin. The only fingerprintable endpoint is the plugin's csv.php file.

This repository contains a Python-based exploit for CVE-2024-27956, a critical unauthenticated SQL injection vulnerability in the WP Automatic plugin for WordPress (versions prior to 3.9.2.0). The exploit is operational and automates the process of checking for vulnerability and, if successful, creates a new administrative user on the target WordPress site. The main file, Exploit.py, provides a command-line interface allowing the user to specify the target URL, desired username, and password for the new admin account. The exploit works by sending crafted SQL injection payloads via POST requests to the target, first creating a new user in the wp_users table and then granting admin privileges via the wp_usermeta table. The README.md provides detailed usage instructions, requirements, and legal disclaimers. No hardcoded endpoints are present; the target is specified by the user at runtime. The attack vector is network-based, requiring only HTTP/S access to the vulnerable site.

This repository contains a single Python exploit script targeting a vulnerability in the WordPress 'wp-automatic' plugin (likely CVE-2024-27956). The exploit automates the following steps: (1) it performs SQL injection via the vulnerable csv.php endpoint to create a new administrator user ('eviladmin'), (2) logs in as this user, (3) retrieves a nonce required for plugin file editing, (4) uploads a PHP reverse shell to the plugin's index.php file, and (5) triggers the shell to establish a reverse connection to the attacker's machine. The script is operational and provides a working exploit chain for remote code execution. The main endpoints targeted are the plugin's csv.php, login, plugin editor, and admin-ajax.php endpoints. The payload is a PHP reverse shell. The repository is a single-file exploit, written in Python, and is not part of any framework.

This repository contains a Python exploit script (CVE-2024-27956.py) and a README.md. The exploit targets Wordpress sites with the vulnerable 'wp-automatic' plugin, specifically exploiting CVE-2024-27956. The script is operational and multi-threaded, allowing the attacker to target multiple Wordpress instances concurrently by reading a list of URLs/IPs from a file. The exploit works by sending crafted SQL injection payloads to the endpoint '/wp-content/plugins/wp-automatic/inc/csv.php' on each target, first creating a new user ('eviladmin') and then granting this user administrator privileges by manipulating the wp_users and wp_usermeta tables. If successful, the attacker gains full admin access to the Wordpress site. The code is well-structured, with clear separation of argument parsing, request handling, and exploitation logic. The README provides usage instructions and requirements. No hardcoded IPs or domains are present; the script is designed to be used against arbitrary targets specified by the user.

This repository provides a proof-of-concept (POC) for exploiting CVE-2024-27956, a time-based blind SQL injection vulnerability in the 'wp-automatic' WordPress plugin. The repository contains a README.md with detailed setup and exploitation instructions, and a stack.yml file for quickly deploying a WordPress environment with MySQL using Docker Compose. The exploit targets the endpoint '/wp-content/plugins/wp-automatic/inc/csv.php' and demonstrates how to craft HTTP GET requests with specific parameters ('q', 'auth', 'integ') to trigger the SQL injection. The provided payloads use the 'sleep' function to confirm the vulnerability based on response time. No actual exploit code is present; the repository is a POC with setup and manual exploitation guidance. The main attack vector is network-based, targeting a web application endpoint. No hardcoded IPs, domains, or additional endpoints are present beyond the vulnerable plugin path.

This repository contains a Python proof-of-concept exploit for CVE-2024-27956, a SQL injection vulnerability in the ValvePress Automatic WordPress plugin. The exploit consists of two files: a README.md with usage instructions and exploit.py, the main exploit script. The script reads a list of target URLs from a file (list.txt), then for each target, it sends crafted POST requests to the vulnerable /wp-content/plugins/wp-automatic/inc/csv.php endpoint. The first request injects SQL to create a new user ('eviladmin') in the WordPress database, and the second request grants this user administrator privileges. Successful exploitation results in a new admin account on the target WordPress site, which can be used for further attacks, including remote code execution. The exploit is operational and automates the process of exploiting multiple targets. No fake or destructive code is present; the exploit is focused and functional.

This repository contains a working exploit for CVE-2024-27956, a SQL Injection vulnerability in the ValvePress Automatic WordPress plugin. The exploit is implemented in Python (exploit.py) and automates the process of exploiting the vulnerable endpoint (/wp-content/plugins/wp-automatic/inc/csv.php) by sending crafted SQL queries via POST requests. The exploit first creates a new user ('eviladmin') in the WordPress database, then escalates this user's privileges to administrator by inserting the appropriate metadata. The README provides usage instructions and details the SQL payloads used. The exploit requires the target to be running a vulnerable version of the plugin and exposes a clear path to full administrative compromise of the WordPress site, which can lead to remote code execution. The repository is structured simply, with a single exploit script and a README explaining the vulnerability and usage.

This repository contains a suite of Python exploits and a Nuclei template targeting CVE-2024-27956, a critical SQL injection vulnerability in the WP Automatic WordPress plugin (versions < 3.52). The exploit automates the creation of a new administrator account ('eviladmin') by injecting SQL queries via the vulnerable plugin endpoint. After gaining admin access, the script uploads a PHP reverse shell to the plugin directory and triggers it, granting the attacker remote code execution on the server. The repository includes multiple Python scripts (V1-V6) with increasing sophistication: - V1 and V2 perform single-target exploitation, with V2 supporting command-line arguments for target URL and reverse shell parameters. - V3-V6 add support for multi-threaded mass exploitation, subnet scanning, and reading targets from files, making it suitable for large-scale attacks. - The Nuclei template enables automated vulnerability scanning and detection. Key endpoints targeted include the plugin's CSV handler for SQL injection, WordPress login, plugin editor, AJAX handler, and the final reverse shell location. The payload is a PHP reverse shell that connects back to an attacker-controlled host and port, both configurable via script arguments. Overall, the repository provides operational-level, weaponizable exploit code for mass exploitation of vulnerable WordPress sites running the WP Automatic plugin. It is suitable for both targeted and broad attacks, with automation for scanning and exploitation.