Skip to content

Commit 7ccf30d

Browse files
buixorbuixor
authored
Merge branch 'master' into 1776258921-vpatch-CVE-2026-1357 
2 parents ff88aaa + deb083c commit 7ccf30d

9 files changed

Lines changed: 239 additions & 3 deletions

File tree

‎.appsec-tests/vpatch-CVE-2022-3254/CVE-2022-3254.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## autogenerated on 2026-03-30 12:39:17
2+
id: CVE-2022-3254
3+
info:
4+
name: CVE-2022-3254
5+
author: crowdsec
6+
severity: info
7+
description: CVE-2022-3254 testing
8+
tags: appsec-testing
9+
http:
10+
- raw:
11+
- |
12+
GET /wp-admin/admin-ajax.php?action=awpcp-get-regions-options&context=search&parent_type=country&parent=test`+FROM+wp_users+WHERE+1=0+UNION+SELECT+VERSION();--+- HTTP/1.1
13+
Host: {{Hostname}}
14+
Accept: application/json, text/javascript, */*; q=0.01
15+
cookie-reuse: true
16+
matchers:
17+
- type: status
18+
status:
19+
- 403

‎.appsec-tests/vpatch-CVE-2022-3254/config.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## autogenerated on 2026-03-30 12:39:17
2+
appsec-rules:
3+
- ./appsec-rules/crowdsecurity/base-config.yaml
4+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2022-3254.yaml
5+
nuclei_template: CVE-2022-3254.yaml

‎.appsec-tests/vpatch-CVE-2023-3197/CVE-2023-3197.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## autogenerated on 2026-03-30 12:46:51
2+
id: CVE-2023-3197
3+
info:
4+
name: CVE-2023-3197
5+
author: crowdsec
6+
severity: info
7+
description: CVE-2023-3197 testing
8+
tags: appsec-testing
9+
http:
10+
- raw:
11+
- |
12+
GET /wp-json/api/flutter_multi_vendor/product-categories?id=1%20AND%20(SELECT%201%20FROM%20(SELECT%20SLEEP(6))a) HTTP/1.1
13+
Host: {{Hostname}}
14+
Accept: application/json
15+
cookie-reuse: true
16+
matchers:
17+
- type: status
18+
status:
19+
- 403

‎.appsec-tests/vpatch-CVE-2023-3197/config.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## autogenerated on 2026-03-30 12:46:51
2+
appsec-rules:
3+
- ./appsec-rules/crowdsecurity/base-config.yaml
4+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2023-3197.yaml
5+
nuclei_template: CVE-2023-3197.yaml

‎.index.json‎

Lines changed: 65 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1895,6 +1895,32 @@
18951895
}
18961896
}
18971897
},
1898+
"crowdsecurity/vpatch-CVE-2022-3254": {
1899+
"author": "crowdsecurity",
1900+
"content": "IyMgYXV0b2dlbmVyYXRlZCBvbiAyMDI2LTAzLTMwIDEyOjM5OjE3Cm5hbWU6IGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIyLTMyNTQKZGVzY3JpcHRpb246ICdEZXRlY3RzIHVuYXV0aGVudGljYXRlZCBTUUwgaW5qZWN0aW9uIGluIEFXUCBDbGFzc2lmaWVkcyB2aWEgYWRtaW4tYWpheC5waHAgYWN0aW9uIGF3cGNwLWdldC1yZWdpb25zLW9wdGlvbnMuJwpydWxlczoKICAtIGFuZDoKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gVVJJCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IC93cC1hZG1pbi9hZG1pbi1hamF4LnBocAogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBBUkdTCiAgICAgICAgdmFyaWFibGVzOgogICAgICAgICAgLSBwYXJlbnQKICAgICAgICB0cmFuc2Zvcm06CiAgICAgICAgICAtIGxvd2VyY2FzZQogICAgICAgICAgLSB1cmxkZWNvZGUKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IHJlZ2V4CiAgICAgICAgICB2YWx1ZTogIlteYS16MC05XSIKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gQVJHUwogICAgICAgIHZhcmlhYmxlczoKICAgICAgICAgIC0gYWN0aW9uCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBlcXVhbHMKICAgICAgICAgIHZhbHVlOiBhd3BjcC1nZXQtcmVnaW9ucy1vcHRpb25zCgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICdodHRwOmV4cGxvaXQnCiAgbGFiZWw6ICdBV1AgQ2xhc3NpZmllZHMgLSBTUUxJJwogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBjdmUuQ1ZFLTIwMjItMzI1NAogICAgLSBhdHRhY2suVDExOTAKICAgIC0gY3dlLkNXRS04OQo=",
1901+
"description": "Detects unauthenticated SQL injection in AWP Classifieds via admin-ajax.php action awpcp-get-regions-options.",
1902+
"labels": {
1903+
"behavior": "http:exploit",
1904+
"classification": [
1905+
"cve.CVE-2022-3254",
1906+
"attack.T1190",
1907+
"cwe.CWE-89"
1908+
],
1909+
"confidence": 3,
1910+
"label": "AWP Classifieds - SQLI",
1911+
"service": "http",
1912+
"spoofable": 0,
1913+
"type": "exploit"
1914+
},
1915+
"path": "appsec-rules/crowdsecurity/vpatch-CVE-2022-3254.yaml",
1916+
"version": "0.1",
1917+
"versions": {
1918+
"0.1": {
1919+
"deprecated": false,
1920+
"digest": "373a3b40761e729e344e66253eb5fb8f0e2ce4e7e699b7f5ef45ef34063870f0"
1921+
}
1922+
}
1923+
},
18981924
"crowdsecurity/vpatch-CVE-2022-35914": {
18991925
"author": "crowdsecurity",
19001926
"content": "bmFtZTogY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjItMzU5MTQKZGVzY3JpcHRpb246ICJHTFBJIFJDRSAoQ1ZFLTIwMjItMzU5MTQpIgpydWxlczoKICAtIGFuZDoKICAgIC0gem9uZXM6CiAgICAgIC0gVVJJCiAgICAgIHRyYW5zZm9ybToKICAgICAgLSBsb3dlcmNhc2UKICAgICAgbWF0Y2g6CiAgICAgICAgdHlwZTogZW5kc1dpdGgKICAgICAgICB2YWx1ZTogL3ZlbmRvci9odG1sYXdlZC9odG1sYXdlZC9odG1sYXdlZHRlc3QucGhwCgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJHTFBJIC0gUkNFIgogIGNsYXNzaWZpY2F0aW9uOgogICAtIGN2ZS5DVkUtMjAyMi0zNTkxNAogICAtIGF0dGFjay5UMTU5NQogICAtIGF0dGFjay5UMTE5MAogICAtIGN3ZS5DV0UtNzQ=",
@@ -2569,6 +2595,32 @@
25692595
}
25702596
}
25712597
},
2598+
"crowdsecurity/vpatch-CVE-2023-3197": {
2599+
"author": "crowdsecurity",
2600+
"content": "IyMgYXV0b2dlbmVyYXRlZCBvbiAyMDI2LTAzLTMwIDEyOjQ2OjUxCm5hbWU6IGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTMxOTcKZGVzY3JpcHRpb246ICdEZXRlY3RzIHVuYXV0aGVudGljYXRlZCBTUUwgaW5qZWN0aW9uIGluIFdvcmRQcmVzcyBNU3RvcmUgQVBJIHBsdWdpbiB2aWEgaWQgcGFyYW1ldGVyLicKcnVsZXM6CiAgLSBhbmQ6CiAgICAgIC0gem9uZXM6CiAgICAgICAgICAtIFVSSQogICAgICAgIHRyYW5zZm9ybToKICAgICAgICAgIC0gbG93ZXJjYXNlCiAgICAgICAgICAtIHVybGRlY29kZQogICAgICAgIG1hdGNoOgogICAgICAgICAgdHlwZTogY29udGFpbnMKICAgICAgICAgIHZhbHVlOiAvd3AtanNvbi9hcGkvZmx1dHRlcl9tdWx0aV92ZW5kb3IvcHJvZHVjdC1jYXRlZ29yaWVzCiAgICAgIC0gem9uZXM6CiAgICAgICAgICAtIEFSR1MKICAgICAgICB2YXJpYWJsZXM6CiAgICAgICAgICAtIGlkCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiByZWdleAogICAgICAgICAgdmFsdWU6ICdbXmEtejAtOV0nCgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICdodHRwOmV4cGxvaXQnCiAgbGFiZWw6ICdXb3JkUHJlc3MgTVN0b3JlIEFQSSAtIFNRTEknCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGN2ZS5DVkUtMjAyMy0zMTk3CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjd2UuQ1dFLTg5Cg==",
2601+
"description": "Detects unauthenticated SQL injection in WordPress MStore API plugin via id parameter.",
2602+
"labels": {
2603+
"behavior": "http:exploit",
2604+
"classification": [
2605+
"cve.CVE-2023-3197",
2606+
"attack.T1190",
2607+
"cwe.CWE-89"
2608+
],
2609+
"confidence": 3,
2610+
"label": "WordPress MStore API - SQLI",
2611+
"service": "http",
2612+
"spoofable": 0,
2613+
"type": "exploit"
2614+
},
2615+
"path": "appsec-rules/crowdsecurity/vpatch-CVE-2023-3197.yaml",
2616+
"version": "0.1",
2617+
"versions": {
2618+
"0.1": {
2619+
"deprecated": false,
2620+
"digest": "3aa0ba2809288c222157e493466cd4fde98fdbbe3674442cd5d56c9a9d003ba5"
2621+
}
2622+
}
2623+
},
25722624
"crowdsecurity/vpatch-CVE-2023-33617": {
25732625
"author": "crowdsecurity",
25742626
"content": "bmFtZTogY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtMzM2MTcKZGVzY3JpcHRpb246ICJBdGxhc3NpYW4gQ29uZmx1ZW5jZSBQcml2ZXNjIChDVkUtMjAyMy0zMzYxNykiCnJ1bGVzOgogIC0gYW5kOgogICAgLSB6b25lczoKICAgICAgLSBNRVRIT0QKICAgICAgdHJhbnNmb3JtOgogICAgICAtIGxvd2VyY2FzZQogICAgICBtYXRjaDoKICAgICAgICB0eXBlOiBlcXVhbHMKICAgICAgICB2YWx1ZTogcG9zdAogICAgLSB6b25lczoKICAgICAgLSBVUkkKICAgICAgdHJhbnNmb3JtOgogICAgICAtIGxvd2VyY2FzZQogICAgICBtYXRjaDoKICAgICAgICB0eXBlOiBlbmRzV2l0aAogICAgICAgIHZhbHVlOiAvYm9hZm9ybS9hZG1pbi9mb3JtbG9naW4KICAgIC0gem9uZXM6CiAgICAgIC0gQk9EWV9BUkdTCiAgICAgIHZhcmlhYmxlczoKICAgICAgIC0gdXNlcm5hbWUKICAgICAgdHJhbnNmb3JtOgogICAgICAtIGxvd2VyY2FzZQogICAgICBtYXRjaDoKICAgICAgICB0eXBlOiBlcXVhbHMKICAgICAgICB2YWx1ZTogImFkbWluIgogICAgLSB6b25lczoKICAgICAgLSBCT0RZX0FSR1MKICAgICAgdmFyaWFibGVzOgogICAgICAgLSBwc2QKICAgICAgdHJhbnNmb3JtOgogICAgICAtIGxvd2VyY2FzZQogICAgICBtYXRjaDoKICAgICAgICB0eXBlOiBlcXVhbHMKICAgICAgICB2YWx1ZTogInBhcmtzIgogIC0gYW5kOgogICAgLSB6b25lczoKICAgICAgLSBNRVRIT0QKICAgICAgbWF0Y2g6CiAgICAgICAgdHlwZTogZXF1YWxzCiAgICAgICAgdmFsdWU6IFBPU1QKICAgIC0gem9uZXM6CiAgICAgIC0gVVJJCiAgICAgIHRyYW5zZm9ybToKICAgICAgLSBsb3dlcmNhc2UKICAgICAgbWF0Y2g6CiAgICAgICAgdHlwZTogZW5kc1dpdGgKICAgICAgICB2YWx1ZTogL2JvYWZvcm0vYWRtaW4vZm9ybXBpbmcKICAgIC0gem9uZXM6CiAgICAgIC0gQk9EWV9BUkdTCiAgICAgIHZhcmlhYmxlczoKICAgICAgLSB0YXJnZXRfYWRkcgogICAgICB0cmFuc2Zvcm06CiAgICAgIC0gbG93ZXJjYXNlCiAgICAgIG1hdGNoOgogICAgICAgIHR5cGU6IHJlZ2V4CiAgICAgICAgdmFsdWU6ICJbXmEtZjAtOTouXSsiCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIkF0bGFzc2lhbiBDb25mbHVlbmNlIC0gUHJpdmlsZWdlIEVzY2FsYXRpb24iCiAgY2xhc3NpZmljYXRpb246CiAgIC0gY3ZlLkNWRS0yMDIzLTMzNjE3CiAgIC0gYXR0YWNrLlQxNTk1CiAgIC0gYXR0YWNrLlQxMTkwCiAgIC0gY3dlLkNXRS03OA==",
@@ -8643,10 +8695,12 @@
86438695
"crowdsecurity/vpatch-CVE-2024-1071",
86448696
"crowdsecurity/generic-wordpress-uploads-php",
86458697
"crowdsecurity/vpatch-CVE-2024-6205",
8646-
"crowdsecurity/generic-wordpress-uploads-listing"
8698+
"crowdsecurity/vpatch-CVE-2022-3254",
8699+
"crowdsecurity/generic-wordpress-uploads-listing",
8700+
"crowdsecurity/vpatch-CVE-2023-3197"
86478701
],
86488702
"author": "crowdsecurity",
8649-
"content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtd29yZHByZXNzCmFwcHNlYy1ydWxlczoKICAtIGNyb3dkc2VjdXJpdHkvYmFzZS1jb25maWcKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTA2MDAKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTA5MDAKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTIwMDkKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTIzNDg4CiAgLSBjcm93ZHNlY3VyaXR5L3ZwYXRjaC1DVkUtMjAyMy0yMzQ4OQogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNDYzNAogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNjM2MAogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNjU2NwogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNjYyMwogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjQtMTA2MQogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjQtMTA3MQogIC0gY3Jvd2RzZWN1cml0eS9nZW5lcmljLXdvcmRwcmVzcy11cGxvYWRzLXBocAogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjQtNjIwNQogIC0gY3Jvd2RzZWN1cml0eS9nZW5lcmljLXdvcmRwcmVzcy11cGxvYWRzLWxpc3RpbmcKYXBwc2VjLWNvbmZpZ3M6CiAgLSBjcm93ZHNlY3VyaXR5L3ZpcnR1YWwtcGF0Y2hpbmcKcGFyc2VyczoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWxvZ3MKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtdnBhdGNoCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1uYXRpdmUKY29udGV4dHM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19iYXNlCmRlc2NyaXB0aW9uOiAiQSB2aXJ0dWFsIHBhdGNoaW5nIGNvbGxlY3Rpb24sIHN1aXRhYmxlIGZvciBXb3JkUHJlc3Mgd2Vic2l0ZXMiCmxhYmVsczoKICBsYWJlbDogIldvcmRQcmVzcyAtIFdBRiBSdWxlcyIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSB3YWYK",
8703+
"content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtd29yZHByZXNzCmFwcHNlYy1ydWxlczoKICAtIGNyb3dkc2VjdXJpdHkvYmFzZS1jb25maWcKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTA2MDAKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTA5MDAKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTIwMDkKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTIzNDg4CiAgLSBjcm93ZHNlY3VyaXR5L3ZwYXRjaC1DVkUtMjAyMy0yMzQ4OQogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNDYzNAogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNjM2MAogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNjU2NwogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjMtNjYyMwogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjQtMTA2MQogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjQtMTA3MQogIC0gY3Jvd2RzZWN1cml0eS9nZW5lcmljLXdvcmRwcmVzcy11cGxvYWRzLXBocAogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjQtNjIwNQogIC0gY3Jvd2RzZWN1cml0eS92cGF0Y2gtQ1ZFLTIwMjItMzI1NAogIC0gY3Jvd2RzZWN1cml0eS9nZW5lcmljLXdvcmRwcmVzcy11cGxvYWRzLWxpc3RpbmcKICAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDIzLTMxOTcKYXBwc2VjLWNvbmZpZ3M6CiAgLSBjcm93ZHNlY3VyaXR5L3ZpcnR1YWwtcGF0Y2hpbmcKcGFyc2VyczoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWxvZ3MKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtdnBhdGNoCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1uYXRpdmUKY29udGV4dHM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19iYXNlCmRlc2NyaXB0aW9uOiAiQSB2aXJ0dWFsIHBhdGNoaW5nIGNvbGxlY3Rpb24sIHN1aXRhYmxlIGZvciBXb3JkUHJlc3Mgd2Vic2l0ZXMiCmxhYmVsczoKICBsYWJlbDogIldvcmRQcmVzcyAtIFdBRiBSdWxlcyIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSB3YWYK",
86508704
"contexts": [
86518705
"crowdsecurity/appsec_base"
86528706
],
@@ -8663,7 +8717,7 @@
86638717
"crowdsecurity/appsec-vpatch",
86648718
"crowdsecurity/appsec-native"
86658719
],
8666-
"version": "0.7",
8720+
"version": "0.9",
86678721
"versions": {
86688722
"0.1": {
86698723
"deprecated": false,
@@ -8692,6 +8746,14 @@
86928746
"0.7": {
86938747
"deprecated": false,
86948748
"digest": "37d84182a2fc459aec85da16d52c245971d3901c580d7d74175fe4d135aaae75"
8749+
},
8750+
"0.8": {
8751+
"deprecated": false,
8752+
"digest": "8275e964719ea8bc0530c9fd06fad7e6ed4975a80cc1d94c4e82c2ca67c0cb1c"
8753+
},
8754+
"0.9": {
8755+
"deprecated": false,
8756+
"digest": "81650393ee520918ae7299d7c0f3809d4707714421e62445ab5357e3fc7207d1"
86958757
}
86968758
}
86978759
},

‎appsec-rules/crowdsecurity/vpatch-CVE-2022-3254.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
## autogenerated on 2026-03-30 12:39:17
2+
name: crowdsecurity/vpatch-CVE-2022-3254
3+
description: 'Detects unauthenticated SQL injection in AWP Classifieds via admin-ajax.php action awpcp-get-regions-options.'
4+
rules:
5+
- and:
6+
- zones:
7+
- URI
8+
transform:
9+
- lowercase
10+
- urldecode
11+
match:
12+
type: contains
13+
value: /wp-admin/admin-ajax.php
14+
- zones:
15+
- ARGS
16+
variables:
17+
- parent
18+
transform:
19+
- lowercase
20+
- urldecode
21+
match:
22+
type: regex
23+
value: "[^a-z0-9]"
24+
- zones:
25+
- ARGS
26+
variables:
27+
- action
28+
transform:
29+
- lowercase
30+
- urldecode
31+
match:
32+
type: equals
33+
value: awpcp-get-regions-options
34+
35+
labels:
36+
type: exploit
37+
service: http
38+
confidence: 3
39+
spoofable: 0
40+
behavior: 'http:exploit'
41+
label: 'AWP Classifieds - SQLI'
42+
classification:
43+
- cve.CVE-2022-3254
44+
- attack.T1190
45+
- cwe.CWE-89

‎appsec-rules/crowdsecurity/vpatch-CVE-2023-3197.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
## autogenerated on 2026-03-30 12:46:51
2+
name: crowdsecurity/vpatch-CVE-2023-3197
3+
description: 'Detects unauthenticated SQL injection in WordPress MStore API plugin via id parameter.'
4+
rules:
5+
- and:
6+
- zones:
7+
- URI
8+
transform:
9+
- lowercase
10+
- urldecode
11+
match:
12+
type: contains
13+
value: /wp-json/api/flutter_multi_vendor/product-categories
14+
- zones:
15+
- ARGS
16+
variables:
17+
- id
18+
transform:
19+
- lowercase
20+
- urldecode
21+
match:
22+
type: regex
23+
value: '[^a-z0-9]'
24+
25+
labels:
26+
type: exploit
27+
service: http
28+
confidence: 3
29+
spoofable: 0
30+
behavior: 'http:exploit'
31+
label: 'WordPress MStore API - SQLI'
32+
classification:
33+
- cve.CVE-2023-3197
34+
- attack.T1190
35+
- cwe.CWE-89

‎collections/crowdsecurity/appsec-wordpress.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@ appsec-rules:
1414
- crowdsecurity/vpatch-CVE-2024-1071
1515
- crowdsecurity/generic-wordpress-uploads-php
1616
- crowdsecurity/vpatch-CVE-2024-6205
17+
- crowdsecurity/vpatch-CVE-2022-3254
1718
- crowdsecurity/generic-wordpress-uploads-listing
19+
- crowdsecurity/vpatch-CVE-2023-3197
1820
appsec-configs:
1921
- crowdsecurity/virtual-patching
2022
parsers:

‎taxonomy/scenarios.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1122,6 +1122,28 @@
11221122
"CWE-94"
11231123
]
11241124
},
1125+
"crowdsecurity/vpatch-CVE-2022-3254": {
1126+
"name": "crowdsecurity/vpatch-CVE-2022-3254",
1127+
"description": "Detects unauthenticated SQL injection in AWP Classifieds via admin-ajax.php action awpcp-get-regions-options.",
1128+
"label": "AWP Classifieds - SQLI",
1129+
"behaviors": [
1130+
"http:exploit"
1131+
],
1132+
"mitre_attacks": [
1133+
"TA0001:T1190"
1134+
],
1135+
"confidence": 3,
1136+
"spoofable": 0,
1137+
"cti": true,
1138+
"service": "http",
1139+
"created_at": "2026-04-15T13:43:05",
1140+
"cves": [
1141+
"CVE-2022-3254"
1142+
],
1143+
"cwes": [
1144+
"CWE-89"
1145+
]
1146+
},
11251147
"crowdsecurity/vpatch-CVE-2022-35914": {
11261148
"name": "crowdsecurity/vpatch-CVE-2022-35914",
11271149
"description": "GLPI RCE (CVE-2022-35914)",
@@ -1579,6 +1601,28 @@
15791601
"CWE-79"
15801602
]
15811603
},
1604+
"crowdsecurity/vpatch-CVE-2023-3197": {
1605+
"name": "crowdsecurity/vpatch-CVE-2023-3197",
1606+
"description": "Detects unauthenticated SQL injection in WordPress MStore API plugin via id parameter.",
1607+
"label": "WordPress MStore API - SQLI",
1608+
"behaviors": [
1609+
"http:exploit"
1610+
],
1611+
"mitre_attacks": [
1612+
"TA0001:T1190"
1613+
],
1614+
"confidence": 3,
1615+
"spoofable": 0,
1616+
"cti": true,
1617+
"service": "http",
1618+
"created_at": "2026-04-15T13:44:20",
1619+
"cves": [
1620+
"CVE-2023-3197"
1621+
],
1622+
"cwes": [
1623+
"CWE-89"
1624+
]
1625+
},
15821626
"crowdsecurity/vpatch-CVE-2023-33617": {
15831627
"name": "crowdsecurity/vpatch-CVE-2023-33617",
15841628
"description": "Atlassian Confluence Privesc (CVE-2023-33617)",

0 commit comments

Comments
 (0)