.. / CVE-2022-0679

• LFI
• Nuclei
• Web

Exploit for WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion (CVE-2022-0679)

Description:

WordPress Narnoo Distributor plugin 2.5.1 and prior is susceptible to local file inclusion. The plugin does not validate and sanitize the lib_path parameter before being passed into a call to require() via the narnoo_distributor_lib_request AJAX action, and the content of the file is displayed in the response as JSON data. This can also lead to a remote code execution vulnerability depending on system and configuration.

Nuclei Template

View the template here CVE-2022-0679.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-0679.yaml

References: