Published: 16/05/2022 Updated: 14/03/2024

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Fusion Builder WordPress plugin prior to 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fusion builder project fusion builder
theme-fusion avada

CVE-2022-1386 - Fusion Builder < 362 - Unauthenticated SSRF Description Fusion Builder is a WordPress plugin that allows users to create and edit pages using a drag-and-drop interface It is vulnerable to an unauthenticated SSRF that allows an attacker to read any file on the server Proof of Concept Request: POST /wp-admin/admin-ajaxphp HTTP/11 Host: examplecom Us

CVE-2022-1386 Check for SSRF/BLIND SSRF and Executed payloads $ python3 CVE-2022-1386py

Automatic Mass Tool for checking vulnerability in CVE-2022-1386 - Fusion Builder < 3.6.2 - Unauthenticated SSRF

Fubucker | CVE-2022-1386 - Fusion Builder Automatic Mass Tool for checking vulnerability in CVE-2022-1386 - Fusion Builder < 362 - Unauthenticated SSRFUsing GNU Parallel You must have parallel for running this toolIf you found error like "$'\r': command not found" just do "dos2unix fubuckersh" Install Parallel Linux : command # apt-get

git clone githubcom/satyasai1460/CVE-2022-1386git cd CVE-2022-1386 apt install python3-pip pip install -r requirementstxt python3 exploitpy

CWE-918 https://www.rootshellsecurity.net/rootshell-discovered-a-critical-vulnerability-in-top-wordpress-theme/https://theme-fusion.com/version-7-6-2-security-update/https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536b https://nvd.nist.gov https://github.com/ardzz/CVE-2022-1386 https://github.com/im-hanzou/fubucker

CVE-2022-1386

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect