neko
e58bb493af
Full RCE exploit chain for two critical PHP vulnerabilities in the multipart parser and session upload progress handler, plus three bypass exploits that defeat the official security patch (PHP 8.4.27) and all recommended mitigations. Core exploits: - CVE-2026-109618: OOM in multipart parser → session persistence → LFI → RCE - CVE-2026-109619: Session poisoning via upload progress (direct + race) → RCE - WordPress-targeted wrapper with LFI auto-detection Patch bypass exploits (confirmed RCE on PHP 8.4.27): - Race condition: TOCTOU inherent to upload progress feature design - RLIMIT_AS: mmap() failure bypasses the patched OOM handler - /proc/PID/fd: temp file inclusion bypasses ALL mitigations
35 lines
1.2 KiB
PHP
35 lines
1.2 KiB
PHP
<?php
|
|
/**
|
|
* Plugin Name: Analytics Dashboard (Vulnerable Demo)
|
|
* Description: Simulates a real-world WordPress plugin with PHP sessions and an
|
|
* LFI vulnerability. Represents plugins like WooCommerce session
|
|
* handlers, theme builders with template inclusion, etc.
|
|
* Version: 1.0.0
|
|
*
|
|
* Install as mu-plugin:
|
|
* cp vuln-plugin.php /path/to/wordpress/wp-content/mu-plugins/
|
|
*
|
|
* This plugin:
|
|
* 1. Calls session_start() on every request (like WooCommerce, etc.)
|
|
* 2. Has a template include that accepts user input (like theme builders)
|
|
* 3. Registers an AJAX endpoint accessible to unauthenticated users
|
|
*/
|
|
|
|
// Start PHP sessions (common in e-commerce/analytics plugins)
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_start();
|
|
}
|
|
|
|
// Register an unauthenticated AJAX handler with LFI
|
|
add_action('wp_ajax_nopriv_analytics_render', 'analytics_render_template');
|
|
add_action('wp_ajax_analytics_render', 'analytics_render_template');
|
|
|
|
function analytics_render_template() {
|
|
$template = isset($_GET['template']) ? $_GET['template'] : 'default';
|
|
// Vulnerable: no path validation on template parameter
|
|
if (file_exists($template)) {
|
|
include($template);
|
|
}
|
|
wp_die();
|
|
}
|