.. / CVE-2021-39312

• LFI
• Nuclei
• Web

Exploit for WordPress True Ranker <2.2.4 - Local File Inclusion (CVE-2021-39312)

Description:

WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file via local file inclusion.

Nuclei Template

View the template here CVE-2021-39312.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-39312.yaml

References: