.. / CVE-2014-5111

• LFI
• Nuclei
• Web

Exploit for Fonality trixbox - Local File Inclusion (CVE-2014-5111)

Description:

Multiple local file inclusion vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.

Nuclei Template

View the template here CVE-2014-5111.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2014/CVE-2014-5111.yaml

References: