.. / CVE-2018-10822

• LFI
• Nuclei
• Web

Exploit for D-Link Routers - Local File Inclusion (CVE-2018-10822)

Description:

D-Link routers DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02,DWR-512 through 2.02,DWR-712 through 2.02,DWR-912 through 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably others with the same type of firmware allows remote attackers to read arbitrary files via a /.. or // after “GET /uir” in an HTTP request to the web interface.

Nuclei Template

View the template here CVE-2018-10822.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-10822.yaml

References: