.. / CVE-2022-1391

• LFI
• Nuclei
• Web

Exploit for WordPress Cab fare calculator < 1.0.4 - Local File Inclusion (CVE-2022-1391)

Description:

The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.

Nuclei Template

View the template here CVE-2022-1391.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-1391.yaml

References: