Create CVE-2022-0320.yaml

[princechaddha]

Template / PR Information

• Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
• References:

Template Validation

I've validated this template locally?

• [ ] YES
• [ ] NO

Additional Details (leave it blank if not applicable)

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[daffainfo]

Hi @akincibor, in the request

action=load_more&class=Essential_Addons_Elementor%5CElements%5CPost_Grid&args=orderby%3Ddate%26order%3Ddesc%26ignore_sticky_posts%3D1%26post_status%3Dpublish%26posts_per_page%3D4%26offset%3D0%26post_type%3Dpost&page=2&page_id=5512&widget_id=19f1b2c&nonce=7c9c8da06d&template_info%5Bdir%5D=lite&template_info%5Bfile_name%5D=..%2f..%2f..%2f..%2f..%2f..%2f.htaccess&template_info%5Bname%5D=Post-Grid

There are some interesting parameters to check

• page_id
• widget_id
• nonce

Can you explain, where do you get the value from these parameters?

Because I think its impossible to create the template because the attacker needs to find the page that contain post grid button first to get the value of page_id, widget_id, and nonce token and then you can request to wp-admin/admin-ajax.php

[daffainfo]

But if someone makes a template to check the version, I think it's still possible :)

[akincibor]

You're right, I didn't pay attention to that.

[daffainfo]

No problem bro, keep it up. I am always waiting for your template :))

[princechaddha]

I am closing this PR due to inactivity and the team not being able to reproduce the CVE in this template