DATABASE RESOURCES PRICING ABOUT US

{"id": "WPEX-ID:47652B24-A6F0-4BBC-834E-496B88523FE7", "vendorId": null, "type": "wpexploit", "bulletinFamily": "exploit", "title": "Cost Calculator <= 1.8 - Authenticated Local File Inclusion", "description": "The plugin allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.8) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout\n", "published": "2022-02-01T00:00:00", "modified": "2022-05-24T08:02:25", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 4.0}, "severity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "href": "", "reporter": "apple502j", "references": [], "cvelist": ["CVE-2021-24820"], "immutableFields": [], "lastseen": "2022-05-24T20:09:30", "viewCount": 30, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-24820"]}, {"type": "wpexploit", "idList": ["WPEX-ID:6DC5558F-D1F4-4BA3-B6F3-8C4E15D9738E"]}, {"type": "wpvulndb", "idList": ["WPVDB-ID:47652B24-A6F0-4BBC-834E-496B88523FE7", "WPVDB-ID:6DC5558F-D1F4-4BA3-B6F3-8C4E15D9738E"]}], "rev": 4}, "score": {"value": 4.4, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2021-24820"]}, {"type": "wpexploit", "idList": ["WPEX-ID:6DC5558F-D1F4-4BA3-B6F3-8C4E15D9738E"]}, {"type": "wpvulndb", "idList": ["WPVDB-ID:6DC5558F-D1F4-4BA3-B6F3-8C4E15D9738E"]}]}, "exploitation": null, "vulnersScore": 4.4}, "_state": {"dependencies": 0}, "_internal": {}, "sourceData": "As a contributor, create a Cost Calculator post, set the Layout to /../../../../../../../../../../file (assuming the file to include is at C:\\xampp\\file.php and WordPress is installed at C:\\xampp\\htdocs\\wordpress). Save as draft, then embde the calculator using the related shortcode (e.g [nd_cost_calculator id=\"806\"]) and preview the post to trigger the LFI.", "generation": 0}

{"wpvulndb": [{"lastseen": "2022-02-10T00:00:00", "description": "The plugin allows users with a role as low as Contributor to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout\n\n### PoC\n\nAs a contributor, create a Cost Calculator post, set the Layout to /../../../../../../../../../../file (assuming the file to include is at C:\\xampp\\file.php and WordPress is installed at C:\\xampp\\htdocs\\wordpress). Save as draft, then embde the calculator using the related shortcode (e.g [nd_cost_calculator id=\"806\"]) and preview the post to trigger the LFI.\n", "cvss3": {}, "published": "2021-11-03T00:00:00", "type": "wpvulndb", "title": "Cost Calculator <= 1.4 - Contributor+ Local File Inclusion", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2021-24820"], "modified": "2022-01-26T21:41:14", "id": "WPVDB-ID:6DC5558F-D1F4-4BA3-B6F3-8C4E15D9738E", "href": "https://wpscan.com/vulnerability/6dc5558f-d1f4-4ba3-b6f3-8c4e15d9738e", "sourceData": "", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2022-05-24T20:09:30", "description": "The plugin allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.8) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout\n\n### PoC\n\nAs a contributor, create a Cost Calculator post, set the Layout to /../../../../../../../../../../file (assuming the file to include is at C:\\xampp\\file.php and WordPress is installed at C:\\xampp\\htdocs\\wordpress). Save as draft, then embde the calculator using the related shortcode (e.g [nd_cost_calculator id=\"806\"]) and preview the post to trigger the LFI.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-02-01T00:00:00", "type": "wpvulndb", "title": "Cost Calculator <= 1.8 - Authenticated Local File Inclusion", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-24820"], "modified": "2022-05-24T08:02:25", "id": "WPVDB-ID:47652B24-A6F0-4BBC-834E-496B88523FE7", "href": "https://wpscan.com/vulnerability/47652b24-a6f0-4bbc-834e-496b88523fe7", "sourceData": "", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}], "patchstack": [{"lastseen": "2022-06-01T19:26:24", "description": "Authenticated Local File Inclusion (LFI) vulnerability discovered by apple502j in WordPress Cost Calculator plugin (versions <= 1.6).\n\n## Solution\n\n\nDeactivate and delete. This plugin has been closed as of November 3, 2021 and is not available for download. Reason: Security Issue.\r\n ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-02-01T00:00:00", "type": "patchstack", "title": "WordPress Cost Calculator plugin <= 1.6 - Authenticated Local File Inclusion (LFI) vulnerability", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-24820"], "modified": "2022-02-01T00:00:00", "id": "PATCHSTACK:1CC9544F781A439E38154BAA5647B8E5", "href": "https://patchstack.com/database/vulnerability/nd-projects/wordpress-cost-calculator-plugin-1-6-authenticated-local-file-inclusion-lfi-vulnerability", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2022-06-01T19:28:54", "description": "Local File Inclusion (LFI) vulnerability discovered by apple502j in WordPress Cost Calculator plugin (versions <= 1.4).\n\n## Solution\n\n\nDeactivate and delete. This plugin has been closed as of November 3, 2021 and is not available for download. Reason: Security Issue.\r\n ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-11-03T00:00:00", "type": "patchstack", "title": "WordPress Cost Calculator plugin <= 1.4 - Local File Inclusion (LFI) vulnerability", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-24820"], "modified": "2021-11-03T00:00:00", "id": "PATCHSTACK:A4705840E2EAEB48EC931EB131A6C5B0", "href": "https://patchstack.com/database/vulnerability/nd-projects/wordpress-cost-calculator-plugin-1-4-local-file-inclusion-lfi-vulnerability", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2022-03-23T15:04:13", "description": "The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-02-28T09:15:00", "type": "cve", "title": "CVE-2021-24820", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-24820"], "modified": "2022-03-07T18:09:00", "cpe": ["cpe:/a:bold-themes:cost_calculator:1.6"], "id": "CVE-2021-24820", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-24820", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:bold-themes:cost_calculator:1.6:*:*:*:*:wordpress:*:*"]}], "wpexploit": [{"lastseen": "2022-02-10T00:00:00", "description": "The plugin allows users with a role as low as Contributor to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout\n", "cvss3": {}, "published": "2021-11-03T00:00:00", "type": "wpexploit", "title": "Cost Calculator <= 1.4 - Contributor+ Local File Inclusion", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2021-24820"], "modified": "2022-01-26T21:41:14", "id": "WPEX-ID:6DC5558F-D1F4-4BA3-B6F3-8C4E15D9738E", "href": "", "sourceData": "As a contributor, create a Cost Calculator post, set the Layout to /../../../../../../../../../../file (assuming the file to include is at C:\\xampp\\file.php and WordPress is installed at C:\\xampp\\htdocs\\wordpress). Save as draft, then embde the calculator using the related shortcode (e.g [nd_cost_calculator id=\"806\"]) and preview the post to trigger the LFI.", "cvss": {"score": 0.0, "vector": "NONE"}}]}