Merge pull request #4383 from V35HR4J/master

Create CVE-2022-1392.yaml

cves/2022/CVE-2022-1392.yaml

@@ -0,0 +1,34 @@
+id: CVE-2022-1392
+
+info:
+  name: Videos sync PDF <= 1.7.4 - Unauthenticated LFI
+  author: Veshraj
+  severity: high
+  description: The plugin does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues.
+  reference:
+    - https://wpscan.com/vulnerability/fe3da8c1-ae21-4b70-b3f5-a7d014aa3815
+    - https://packetstormsecurity.com/files/166534/
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1392
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2022-1392
+  tags: lfi,wp-plugin,cve,cve2022,wp,wordpress,unauth
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=tout"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "failed to open stream: No such file or directory"
+          - "REPERTOIRE_VIDEOSYNCPDFreglages/Menu_Plugins/tout.php"
+        condition: and
+
+      - type: status
+        status:
+          - 200