PHP Object Injection in GiveWP WordPress Plugin

This repository provides a working exploit for CVE-2024-8353, a PHP Object Injection vulnerability in the GiveWP plugin for WordPress (versions up to and including 3.16.1). The exploit consists of two main scripts: - 'exploit.py': A Python script that automates the exploitation process. It identifies available forms on the target WordPress site, retrieves required nonces, and delivers a serialized PHP payload to the vulnerable endpoint. The script allows the attacker to specify an arbitrary shell command to execute on the target server. - 'payload.php': A PHP script that constructs a serialized object chain designed to trigger code execution when deserialized by the vulnerable plugin. The default payload demonstrates file creation (touch /tmp/exploit_test), but the Python script can be used to specify other commands. The exploit targets the '/wp-admin/admin-ajax.php' endpoint, using the 'form_search', 'form_nonce', and 'process_form' actions to interact with the GiveWP plugin. The attack vector is network-based, requiring only access to the target's web interface. The repository is well-structured, with clear separation between the exploit logic (Python) and the payload construction (PHP). The README provides detailed usage instructions and context about the vulnerability.

This repository provides a working exploit for CVE-2024-8353, a critical unauthenticated PHP Object Injection vulnerability in the GiveWP donation plugin for WordPress (versions up to 3.16.1). The exploit consists of a Python script (CVE-2024-8353.py) that crafts a serialized PHP object payload and submits it via a POST request to the vulnerable GiveWP donation form endpoint (/wp-admin/admin-ajax.php). The payload leverages a PHP POP chain to achieve remote code execution (RCE) by invoking shell_exec with attacker-controlled input. The included PoC.php file demonstrates the PHP object structure and serialization process used in the attack. The README.md provides detailed usage instructions, environment setup, and technical analysis of the vulnerability and exploitation process. The exploit is operational and allows unauthenticated attackers to execute arbitrary commands on affected WordPress installations. The repository is structured with clear entry points (CVE-2024-8353.py for exploitation, PoC.php for payload generation/testing), and includes all necessary dependencies in requirements.txt.