CVE-2022-1119
HIGH IN THE WILD NUCLEISimple File List <= 3.2.7 - Unauthenticated Arbitrary File Download via eeFile Parameter
Title source: llmExploitation Summary
CVE-2022-1119 has been observed exploited in the wild (reported by InTheWild.io). EIP tracks 1 public exploit from researchers including z92g. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Go-based scanner for CVE-2022-1119, a file read vulnerability in WordPress Simple File List plugin versions < 3.2.8. It checks for the presence of the vulnerability by attempting to read the wp-config.php file via a path traversal payload.
Description
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.
Exploits (1)
This repository contains a Go-based scanner for CVE-2022-1119, a file read vulnerability in WordPress Simple File List plugin versions < 3.2.8. It checks for the presence of the vulnerability by attempting to read the wp-config.php file via a path traversal payload.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N