.. / CVE-2011-1669

Exploit for WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI) (CVE-2011-1669)

Description:

A directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter.

Nuclei Template

View the template here CVE-2011-1669.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2011/CVE-2011-1669.yaml
Copy

References:

https://nvd.nist.gov/vuln/detail/CVE-2011-1669
http://www.exploit-db.com/exploits/17119
https://www.exploit-db.com/exploits/17119
https://exchange.xforce.ibmcloud.com/vulnerabilities/66559
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1669
https://github.com/ARPSyndicate/kenzer-templates