# CVE-2023-6972 Proof of Concept (PoC)

## Description

This repository contains a Proof of Concept (PoC) exploit for **CVE-2023-6972**. 

The vulnerability allows for Unauthenticated Arbitrary File Deletion (AFD) in Wordpress Backup Migration Plugin `<=1.3.9` , Which can be chained to RCE By Deleting `wp-config.php` . This exploit script automates the vulnerability check and exploitation process.

> **Note:** A comprehensive technical breakdown, full case study, and root cause analysis of this exploit available at https://medium.com/@phantom_hat/cve-2023-6972-wordpress-backup-migration-1-3-9-arbitrary-file-deletion-case-study-ccea1c5f8c4e

## Vulnerability Details
- **CVE ID:** CVE-2023-6972
- **NVD Link:** [https://nvd.nist.gov/vuln/detail/CVE-2023-6972](https://nvd.nist.gov/vuln/detail/CVE-2023-6972)

## Disclaimer

**For Educational and Authorized Security Testing Purposes Only.**
This script is provided "as is" and the author holds no responsibility for any misuse or damage caused by its use. Always obtain explicit, written permission from the system owner before conducting any security testing.

## Prerequisites

- Python 3.x
- `requests` library
- `rich` library (for the CLI interface)

Install the required dependencies:
```bash
pip install -r requirements.txt
```

## Usage

The exploit script (`exploit.py`) provides a CLI interface with two distinct modes:

### 1. Check Mode
Validates if the target URL is vulnerable to CVE-2023-6972 without firing the exploit.

```bash
python3 exploit.py check -u <TARGET_URL>
```

**Example:**
```bash
python3 exploit.py check -u http://example.com
```

### 2. Exploit Mode
Executes the vulnerability against the target URL.

```bash
python3 exploit.py exploit -u <TARGET_URL> -f <FILE_PATH> -n <FILE_NAME>
```

**Options:**
- `-u` / `--url`: The target URL.
- `-f` / `--file-path`: The directory path to delete the file.
- `-n` / `--file-name`: The desired name of the file which you want to delete.

**Example:**
```bash
python3 exploit.py exploit -u http://127.0.0.1 -f /tmp -n delete-me.txt
```

### Verbose Mode
You can add the `-v` or `--verbose` flag to either command to enable detailed, and formatted visual logging and output.

```bash
python3 exploit.py exploit -u http://127.0.0.1 -f /tmp -n delete-me.txt --verbose
```
