CVE-2024-52433 Scanner
CVE-2024-52433 Scanner - PHP Object Injection vulnerability in My Geo Posts Free
Short Info
Level
Critical
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
12 days 23 hours
Scan only one
Domain, IPv4
Toolbox
-
The My Geo Posts Free plugin is a tool designed for WordPress users to geotag posts and display them in unique ways. It is popular among small businesses and bloggers who aim to localize content. The plugin provides features to enhance geographical-based content visibility, ensuring posts are contextually relevant to a user’s location.
The vulnerability detected allows unauthenticated attackers to perform PHP Object Injection via deserialization of untrusted input. While no known POP (Property Oriented Programming) chain is present in the software itself, the issue becomes severe if other plugins or themes include exploitable POP chains. Such a setup could lead to critical impacts like file deletion, sensitive data retrieval, or arbitrary code execution.
The technical root of this vulnerability lies in how the plugin processes serialized data within its cookie handling. Attackers can exploit the vulnerable endpoint by injecting malicious serialized data, enabling them to execute unintended commands if additional exploitable chains exist. Successful exploitation hinges on other vulnerable plugins or themes within the system environment.
If exploited, this vulnerability could lead to arbitrary file deletion, sensitive data disclosure, or even remote code execution. This poses significant risks to the integrity, confidentiality, and availability of affected WordPress websites.
REFERENCES
- https://github.com/RandomRobbieBF/CVE-2024-52433
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/my-geo-posts-free/my-geo-posts-free-12-unauthenticated-php-object-injection
- https://patchstack.com/database/vulnerability/my-geo-posts-free/wordpress-my-geo-posts-free-plugin-1-2-php-object-injection-vulnerability?_s_id=cve
- https://nvd.nist.gov/vuln/detail/CVE-2024-52433