20241012

date.txt

@@ -1 +1 @@
-20241011
+20241012

poc/auth/simple-membership-after-login-redirection.yaml

@@ -0,0 +1,59 @@
+id: simple-membership-after-login-redirection
+
+info:
+  name: >
+    Simple Membership After Login Redirection <= 1.6 - Open Redirect
+  author: topscoder
+  severity: low
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f959e61-16cf-4260-b21b-8edb95a3cd65?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/simple-membership-after-login-redirection/"
+    google-query: inurl:"/wp-content/plugins/simple-membership-after-login-redirection/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,simple-membership-after-login-redirection,low
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/simple-membership-after-login-redirection/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "simple-membership-after-login-redirection"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 1.6')

poc/auth/wp-post-author-3f4de7ecb8586f0c99558a166624662d.yaml

@@ -0,0 +1,59 @@
+id: wp-post-author-3f4de7ecb8586f0c99558a166624662d
+
+info:
+  name: >
+    Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection
+  author: topscoder
+  severity: low
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/d667bafc-5f19-4889-a988-236df050c013?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/wp-post-author/"
+    google-query: inurl:"/wp-content/plugins/wp-post-author/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,wp-post-author,low
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/wp-post-author/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "wp-post-author"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 3.8.1')

poc/aws/bridge-core-d2d00414cf6e61ec23999dd4278c171a.yaml

@@ -0,0 +1,59 @@
+id: bridge-core-d2d00414cf6e61ec23999dd4278c171a
+
+info:
+  name: >
+    Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import
+  author: topscoder
+  severity: low
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/968d5d31-2592-4bed-9d18-5877f0d6062e?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/bridge-core/"
+    google-query: inurl:"/wp-content/plugins/bridge-core/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,bridge-core,low
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/bridge-core/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "bridge-core"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 3.3')

poc/cve/CVE-2024-44010.yaml

@@ -0,0 +1,59 @@
+id: CVE-2024-44010
+
+info:
+  name: >
+    Full frame <= 2.7.2 - Authenticated (Author+) Stored Cross-Site Scripting
+  author: topscoder
+  severity: low
+  description: >
+    The Full frame theme for WordPress is vulnerable to Stored Cross-Site Scripting parameter in versions up to, and including, 2.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/b95baf58-bd99-4682-b2eb-46a402c62c03?source=api-prod
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
+    cvss-score: 6.4
+    cve-id: CVE-2024-44010
+  metadata:
+    fofa-query: "wp-content/themes/full-frame/"
+    google-query: inurl:"/wp-content/themes/full-frame/"
+    shodan-query: 'vuln:CVE-2024-44010'
+  tags: cve,wordpress,wp-theme,full-frame,low
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/themes/full-frame/style.css"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Version: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Version: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "full-frame"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 2.7.2')

poc/cve/CVE-2024-45454.yaml

@@ -0,0 +1,59 @@
+id: CVE-2024-45454
+
+info:
+  name: >
+    Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Reflected Cross-Site Scripting
+  author: topscoder
+  severity: medium
+  description: >
+    The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.5.121 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/b49c1e95-7ef4-45d7-9fdf-dd5adffd2eb0?source=api-prod
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2024-45454
+  metadata:
+    fofa-query: "wp-content/plugins/unlimited-elements-for-elementor/"
+    google-query: inurl:"/wp-content/plugins/unlimited-elements-for-elementor/"
+    shodan-query: 'vuln:CVE-2024-45454'
+  tags: cve,wordpress,wp-plugin,unlimited-elements-for-elementor,medium
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/unlimited-elements-for-elementor/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "unlimited-elements-for-elementor"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 1.5.121')

poc/cve/CVE-2024-47348.yaml

@@ -0,0 +1,59 @@
+id: CVE-2024-47348
+
+info:
+  name: >
+    YellowPencil Visual CSS Style Editor <= 7.6.4 - Reflected Cross-Site Scripting
+  author: topscoder
+  severity: medium
+  description: >
+    The YellowPencil Visual CSS Style Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 7.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f325945-8394-4ff5-8868-2b1c464cd91f?source=api-prod
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2024-47348
+  metadata:
+    fofa-query: "wp-content/plugins/yellow-pencil-visual-theme-customizer/"
+    google-query: inurl:"/wp-content/plugins/yellow-pencil-visual-theme-customizer/"
+    shodan-query: 'vuln:CVE-2024-47348'
+  tags: cve,wordpress,wp-plugin,yellow-pencil-visual-theme-customizer,medium
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/yellow-pencil-visual-theme-customizer/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "yellow-pencil-visual-theme-customizer"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 7.6.4')