.. / CVE-2015-1579

• LFI
• Nuclei
• Web

Exploit for WordPress Slider Revolution - Local File Disclosure (CVE-2015-1579)

Description:

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.

Nuclei Template

View the template here CVE-2015-1579.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-1579.yaml

References: