WordPress Upward Themes <1.5 - Open Redirect
ID: wp-upward-theme-redirect
Severity: medium
Author: r3Y3r53
Tags: wordpress,wp-theme,wp,upward,redirect
Description
Section titled “Description”WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
YAML Source
Section titled “YAML Source”id: wp-upward-theme-redirect
info: name: WordPress Upward Themes <1.5 - Open Redirect author: r3Y3r53 severity: medium description: | WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. reference: - https://cxsecurity.com/issue/WLB-2020030133 metadata: verified: true max-request: 1 google-query: inurl:"/wp-content/themes/Upward/" tags: wordpress,wp-theme,wp,upward,redirect
http: - method: GET path: - "{{BaseURL}}/wp-content/themes/Upward/go.php?https://interact.sh"
matchers: - type: regex part: header regex: - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'# digest: 4a0a00473045022100fa3506b7163f77d9c92e052257028e5e2aacda1c23895b192b6b200004be862302205acd138fb33b68e1247392a6906c6b09c6006927d2487ddac7873b69e434291f:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/wp-upward-theme-redirect.yaml"