id: CVE-2022-2552

info:
  name: Duplicator < 1.4.7.1 - Information Disclosure
  author: iamnoooob,ritikchaddha
  severity: medium
  description: |
    The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
  impact: |
    Unauthenticated attackers can access sensitive system information including server software versions, PHP version, and full filesystem paths through the exposed installer endpoint, providing valuable reconnaissance data for targeted attacks.
  remediation: |
    Update Duplicator plugin to version 1.4.7.1 or later that requires authentication before displaying system information.
  reference:
    - https://wpscan.com/vulnerability/6b540712-fda5-4be6-ae4b-bd30a9d9d698/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2552
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-2552
    cwe-id: CWE-862
    epss-score: 0.08106
    epss-percentile: 0.94082
    cpe: cpe:2.3:a:snapcreek:duplicator:*:*:*:*:lite:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/wp-content/plugins/duplicator"
    vendor: snapcreek
    product: wp_go_maps
  tags: cve,cve2022,wp,wp-plugin,wordpress,duplicator,disclosure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/backups-dup-lite/dup-installer/main.installer.php?view=1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'SERVER DETAILS</div>'
          - 'Setup Information'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100b3d108673341194c190f70adf321bde641c7a343d1991b99176b6f445caf0a8f022100bcca3eadf3179109ceca5a1064ddc29dae53ad9ee742539f0017a41c207e0a8c:922c64590222798bb761d5b6d8e72950