id: CVE-2021-24370

info:
  name: Fancy Product Designer WordPress plugin - Remote Code Execution (Detection)
  author: pikpikcu
  severity: critical
  description: |
    Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
  reference:
    - https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/
    - https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24370
    - https://lists.openwall.net/full-disclsure/2020/11/17/2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-24370
    cwe-id: CWE-434,CWE-434
  metadata:
    google-query: inurl:“/wp-content/plugins/fancy-product-designer”
  tags: fancyproduct,wpscan,cve,cve2021,wordpress,rce,wp-plugin,wp

requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"error":"You need to define a directory'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200