CVE-2020-27467

published 2022-02-24

CVE-2020-27467: A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

Priority P2 60 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
processwire	processwire	>= 2.0.0 < 2.7.1	2.7.1

Detection & IOCs extracted from sources · hover to see the quote

url /index.php?download=/etc/passwd↗

• → Look for GET requests to index.php with a 'download' parameter containing path traversal sequences (e.g., /etc/passwd or relative traversal strings). ↗
• → Match HTTP 200 responses containing the regex pattern 'root:[x*]:0:0' to confirm successful /etc/passwd disclosure via the download parameter. ↗
• → Fingerprint exposed Processwire CMS instances using Shodan query 'http.html:"processwire"' or FOFA query 'body="processwire"' to identify potentially vulnerable targets. ↗

• · The vulnerability affects Processwire CMS versions prior to 2.7.1 only; versions 2.7.1 and later are not affected. ↗
• · Exploitation requires no authentication (PR:N, UI:N), making this remotely exploitable by unauthenticated attackers. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 7.8 HIGH AV:N/AC:L/Au:N/C:C/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22