.. / CVE-2022-2633

• SSRF
• Nuclei
• Web

Exploit for All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery (CVE-2022-2633)

Description:

WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery (SSRF) via the ‘dl’ parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server.

Nuclei Template

View the template here CVE-2022-2633.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-2633.yaml

References: