Wordpress Brandfolder - Remote/Local File Inclusion

By kannthu

High

Vidoc Module

#lfi#rfi#edb#wordpress#wp-plugin

Description

Author: 0x_Akoko Classification CWE-ID: CWE-22 CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS-Score: 7.5 WordPress Brandfolder allows remote attackers to access arbitrary files that reside on the local and remote server and disclose their content. Reference - https://www.exploit-db.com/exploits/39591 - https://cxsecurity.com/issue/WLB-2016030120 Metadata max-request: 1

Module preview

Concurrent Requests (1)

1. HTTP Request template

GET/wp-content/plugins/...

Matching conditions

word: DB_NAME, DB_PASSWORDand

status: 200

Passive global matcher

No matching conditions.

On match action

Report vulnerability