CVEs-PoC/2021/CVE-2021-24430.md

### [CVE-2021-24430](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24430)
![](https://img.shields.io/static/v1?label=Product&message=Speed%20Booster%20Pack%20%E2%9A%A1%20PageSpeed%20Optimization%20Suite&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=4.2.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=4.2.0-beta%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)

### Description

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE

### POC

#### Reference
- https://wpscan.com/vulnerability/945d6d2e-fa25-42c0-a7b4-b1794732a0df

#### Github
- https://github.com/20142995/nuclei-templates