WordPress Plugin Age Verification v0.4 - Open Redirect

ID: CVE-2012-6499

Severity: medium

Author: ctflearner

Tags: cve,cve2012,wordpress,wp,wp-plugin,redirect,age-verification,age_verification_project

Description

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.

YAML Source

id: CVE-2012-6499

info:
  name: WordPress Plugin Age Verification v0.4 - Open Redirect
  author: ctflearner
  severity: medium
  description: |
    Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.
  remediation: |
    Update to the latest version of the WordPress Plugin Age Verification or remove the plugin if not needed.
  reference:
    - https://www.exploit-db.com/exploits/18350
    - https://wordpress.org/plugins/age-verification
    - https://nvd.nist.gov/vuln/detail/CVE-2012-6499
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N
    cvss-score: 5.8
    cve-id: CVE-2012-6499
    cwe-id: CWE-20
    epss-score: 0.03575
    epss-percentile: 0.91621
    cpe: cpe:2.3:a:age_verification_project:age_verification:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: age_verification_project
    product: age_verification
  tags: cve,cve2012,wordpress,wp,wp-plugin,redirect,age-verification,age_verification_project

http:
  - raw:
      - |
        POST /wp-content/plugins/age-verification/age-verification.php HTTP/1.1
        Host: {{Hostname}}

        redirect_to=http://www.interact.sh&age_day=1&age_month=1&age_year=1970

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
# digest: 4a0a00473045022100a5f35aad481c8b6609b707bbb6491255f89d6caf3e0b561ea893dbd55f2a120a02200f689070a23ca3a1b7ffaa49538ea436e5dcb7af3ba6e80656f86eef0bc3c598:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2012/CVE-2012-6499.yaml"

View on Github