.. / CVE-2021-24947

• LFI
• Nuclei
• Web

Exploit for WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read (CVE-2021-24947)

Description:

WordPress Responsive Vector Maps < 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user to read arbitrary files on the web server.

Nuclei Template

View the template here CVE-2021-24947.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24947.yaml

References: