diff --git a/http/cves/2023/CVE-2023-34020.yaml b/http/cves/2023/CVE-2023-34020.yaml new file mode 100644 index 0000000000..6e366ad761 --- /dev/null +++ b/http/cves/2023/CVE-2023-34020.yaml @@ -0,0 +1,25 @@ +id: CVE-2023-34020 + +info: + name: Uncanny Toolkit for LearnDash - Open Redirection + author: LeDoubleTake + severity: low + reference: + - https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-open-redirection-vulnerability + - https://wordpress.org/plugins/uncanny-learndash-toolkit/ + metadata: + max-request: 1 + verified: true + publicwww-query: "/wp-content/plugins/uncanny-learndash-toolkit/" + tags: cve,cve2023,wordpress,uncanny-learndash-toolkit,wpscan,redirect + +http: + - method: GET + path: + - "{{BaseURL}}/?rest_route=/ult/v2/review-banner-visibility&action=maybe-later&redirect=yes&redirect_url=https://interact.sh" + + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'