.. / CVE-2023-0159

• RCE
• PoC
• Nuclei
• Web

Exploit for WordPress Plugin Extensive VC Addons < 1.9.1 - Unauthenticated Remote Code Execution (CVE-2023-0159)

Description:

The plugin does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.

Affected Products:

• WordPress Plugin Extensive VC Addons < 1.9.1

Nuclei Template

View the template here CVE-2023-0159.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-0159.yaml

References: