nuclei-templates/cves/CVE-2019-15858.yaml

30 lines
777 B
YAML
Raw Normal View History

2020-10-01 08:02:00 +00:00
id: cve-2019-15858
info:
name: Unauthenticated Woody Ad Snippets WordPress Plugin RCE
author: dwisiswant0
severity: high
description: |
This template supports the detection part only. See references.
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin
before 2.2.5 for WordPress allows unauthenticated options import,
as demonstrated by storing an XSS payload for remote code execution.
Source/References:
- https://github.com/GeneralEG/CVE-2019-15858
requests:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "2.2.5"
part: body