.. / CVE-2012-0896

Exploit for Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access (CVE-2012-0896)

Description:

An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.

Nuclei Template

View the template here CVE-2012-0896.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2012/CVE-2012-0896.yaml
Copy

References:

http://plugins.trac.wordpress.org/changeset/488883/count-per-day
https://exchange.xforce.ibmcloud.com/vulnerabilities/72385
https://packetstormsecurity.com/files/108631/
https://https://nvd.nist.gov/vuln/detail/CVE-2012-0896
http://wordpress.org/extend/plugins/count-per-day/changelog/