.. / CVE-2021-25052

• LFI
• Nuclei
• Web

Exploit for WordPress Button Generator <2.3.3 - Remote File Inclusion (CVE-2021-25052)

Description:

WordPress Button Generator before 2.3.3 within the wow-company admin menu page allows arbitrary file inclusion with PHP extensions (as well as with data:// or http:// protocols), thus leading to cross-site request forgery and remote code execution.

Nuclei Template

View the template here CVE-2021-25052.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-25052.yaml

References: