.. / CVE-2021-39316

• LFI
• Nuclei
• Web

Exploit for WordPress DZS Zoomsounds <=6.50 - Local File Inclusion (CVE-2021-39316)

Description:

WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsap_download action using directory traversal in the link parameter.

Nuclei Template

View the template here CVE-2021-39316.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-39316.yaml

References: