Woocommerce - PDF Invoice Exposure

ID: wp-woocommerce-pdf-invoice-listing

Severity: medium

Author: mohammedsaneem,sec_hawk

Tags: wordpress,listing,exposure,woocommerce

Description

A vulnerability in Woocommerce allows remote unauthenticated attackers to access company invoices and other sensitive information.

YAML Source

id: wp-woocommerce-pdf-invoice-listing

info:
  name: Woocommerce - PDF Invoice Exposure
  author: mohammedsaneem,sec_hawk
  severity: medium
  description: A vulnerability in Woocommerce allows remote unauthenticated attackers to access company invoices and other sensitive information.
  reference:
    - https://twitter.com/sec_hawk/status/1426984595094913025?s=21
    - https://github.com/Mohammedsaneem/wordpress-upload-information-disclosure/blob/main/worpress-upload.yaml
    - https://woocommerce.com/products/pdf-invoices/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: wordpress,listing,exposure,woocommerce

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/pdf-invoices/"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Index of /wp-content/uploads/pdf-invoices"
          - "Parent Directory"
          - ".pdf"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a55a91047afbbd2d628fd90e0f612b51317276557476b36d59560980a67f8458022100fbf54e82a6b330db148b9120afb83c391909470901626b9722eea96c814e4a01:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/wp-woocommerce-pdf-invoice-listing.yaml"

View on Github