WordPress File Upload 插件 /wfu_file_downloader.php 文件读取漏洞（CVE-2024-9047）

2024-12-25 WordPress PoC No

Description

WordPress File Upload插件是一款WordPress网站的实用插件，它允许用户地将文件上传到wp-contents目录， 插件支持自定义字段，同时，它还提供了进度条监视功能，让用户可以实时了解上传进度。WordPress File Upload 插件在 <= 4.24.11 版本中，wfu_file_downloader.php 文件存在任意文件读取漏洞。攻击者可以通过构造恶意请求读取服务器上的任意文件，可能导致敏感信息泄露或进一步的攻击。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://nvd.nist.gov/vuln/detail/CVE-2024-9047
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-file-upload/wordpress-file-upload-42411-unauthenticated-path-traversal-to-arbitrary-file-read-and-deletion-in-wfu-file-downloaderphp
https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload
https://github.com/verylazytech/CVE-2024-9047
https://wpscan.com/vulnerability/2c820bda-9849-450e-b181-1bd4975431d6/
https://avd.aliyun.com/detail?id=AVD-2024-9047
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/WordPress/WordPress%E6%8F%92%E4%BB%B6FileUpload%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0(CVE-2024-9047).md
https://zhuanlan.zhihu.com/p/14674464409
https://blog.csdn.net/m0_46699477/article/details/144724728
https://cve.imfht.com/detail/CVE-2024-9047
https://www.sentinelone.com/vulnerability-database/cve-2024-9047/

Description

PoC

References

Related Vulnerabilities